MalwareOtherRansomwareCapture Stored DataData EncryptedData ExfiltratedEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

BACKROADS

bd_ac67e485d6963e4b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 2, 2020

Filed

Mar 15, 2021

To disclose

23 weeks

Affected

17state residents only

Linked

7 filings

Confidence

67%

Full breach record for BACKROADS →

Backroads reported a supplemental data breach affecting 17 New Hampshire residents (16 initially, 1 additional). On Oct 2, 2020, Backroads detected suspicious activity and found files encrypted. On Oct 16, 2020, it was discovered that files had been accessible to unknown actors and removed prior to encryption. Affected data includes names, DOBs, SSNs, government IDs, financial account info, and health insurance info. Backroads engaged forensics, secured networks, rebuilt infrastructure, and offered one year of credit monitoring via Epiq.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 23 weeks / 164 days

Oct 2, 2020

Discovered

Mar 15, 2021

Filed

vs. sector median

+16 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_e286b5f31a42b0a52021-02-26 · +17dVerified
New Hampshire State AGbd_94c7105fbcd61d632020-11-24 · +111dCandidate
Massachusetts State AGbd_6eadb352e50544e02020-11-19 · +116dVerified
California State AGbd_7381ee0e20a518532020-11-19 · +116dVerified

Show 2 more filings ↓up to 116d gap

Montana State AGbd_8d5027cb14bd22ed2020-11-19 · +116dCandidate
Maine State AGbd_b3d7644895863e402020-11-19 · +116dVerified

Name: Backroads
norm: backroads

Name: BACKROADS
norm: backroads
Industry: Otherllm

Discovered: Oct 2, 2020
Materiality determined: —
Notification sent: Feb 26, 2021
Affected individuals: 17state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General

During the incident: Immediately began an investigation
Worked with third party forensic specialists
Took steps to secure the network
Undertook a comprehensive review of the files to identify those whose personal information may have been accessible
Provided written notice of this incident to affected individuals
Providing access to credit monitoring services for one (1) year, through Epiq
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Rebuilding our network from the ground up
Adding further security measures
Implementing additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(164 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Massachusetts State AGNov 19 · first

California State AGNov 19 · first

Montana State AGNov 19 · first

Maine State AGNov 19 · first

New Hampshire State AG+5d

California State AG+99d

New Hampshire State AG+116d · this page

Pattern: first filing Nov 19 (MA), last Mar 15 (NH) — a 116-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/backroads-20210315.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 15, 2021
Raw hash: b8c0a1e3b69507fd35e23a577bb243ff3c17e14a55d3dbe09ae7e3434c7931a5

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityBackroads

Victim entityBACKROADS

Incidentdiscovered Oct 2, 2020

Stated responseImmediately began an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov