HackingFinancial ServicesFinanceStolen CredentialsRansom DemandedRansom PaidData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Local 295 IBT Employer Group Welfare Fund

bd_acc2dcb63f662ce2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 13, 2022

Filed

Mar 22, 2022

To disclose

10 weeks

Affected

5state residents only

Linked

5 filings

Confidence

66%

Full breach record for Local 295 IBT Employer Group Welfare Fund →

Local 295 IBT Employer Group Pension and Welfare Funds reported a data breach involving its vendor, Horizon Actuarial Services, LLC. Unauthorized access to Horizon's servers occurred on November 10-11, 2021. The attacker claimed to have stolen participant data. Horizon notified the Fund on January 13, 2022. The Fund notified the NH Attorney General on March 22, 2022, affecting 5 NH residents. Data included names, addresses, and government IDs. Ransom was paid to the attacker. Horizon provided credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 64 days

discovery → filing · 10 weeks / 68 days

Nov 10, 2021

Begins

Jan 13, 2022

Discovered

Mar 22, 2022

Filed

vs. sector median

+1 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_6982cd5680a29cd22022-03-22Candidate
Indiana State AGbd_d5dbaf531c8c6ab32022-03-22Verified
Massachusetts State AGbd_2a6f4982277e509b2022-03-23 · +1dVerified by operator
HHS OCRbd_94b34e9a602234962022-03-11 · +11dVerified by operator

Name: Local 295 IBT Employer Group Welfare Fund
norm: local 295 ibt employer group welfare

Name: Local 295 IBT Employer Group Welfare Fund
norm: local 295 ibt employer group welfare
Industry: Financial Servicesllm

Discovered: Jan 13, 2022
Breach occurred: Nov 10, 2021 – Nov 11, 2021
Undetected for: 64 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 22, 2022
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the FBIFiled notice with New Hampshire Attorney General
Third party: via Horizon Actuarial Services, LLCvendor
Initial access: exploit_public_facing

During the incident: Notified the FBI
Engaged third-party computer specialists
Negotiated with and paid the group in exchange for an agreement that they would delete and not distribute or otherwise misuse the stolen information
Appointed a new Chief Information Security Officer
Upgraded its Security Operations Center to include enhanced Management Detection and Response services
Established a rapid response capability to address new cybersecurity threats
Sent notification letters to affected individuals
Changes made: Reviewed its existing security policies
Implemented additional measures to further protect against similar incidents moving forward
Provided complimentary one-year identity monitoring services through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRMar 11 · first

Montana State AG+11d

Indiana State AG+11d

New Hampshire State AG+11d · this page

Massachusetts State AG+12d

Pattern: first filing Mar 11 (NY), last Mar 23 (MA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/local-295-ibt-employer-group-pension-welfare-funds-20220322.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 22, 2022
Raw hash: e544d7fad0e0c166916870f41c1fb379875f4127f0744cf91f70f293ea8dfba4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLocal 295 IBT Employer Group Welfare Fund

Victim entityLocal 295 IBT Employer Group Welfare Fund

Incidentdiscovered Jan 13, 2022

Stated responseNotified the FBI

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov