HackingFinancial ServicesTechnologyFinanceData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)LowContained

Ongoing Operations

bd_ad3fc56c22d4a0d7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 18, 2024

Filed

Aug 27, 2024

To disclose

6 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Ongoing Operations →

New Hampshire Attorney General notification regarding a data security incident affecting Ongoing Operations, a server hosting provider for FedComp (which hosts core services for credit unions). An unauthorized actor accessed data between Nov 13-26, 2023. Discovery occurred July 18, 2024, affecting 1 NH resident. Data involved was identity information. Remediation included third-party investigation, notification, and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 248 days

discovery → filing · 6 weeks / 40 days

Nov 13, 2023

Begins

Jul 18, 2024

Discovered

Aug 27, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_19e6aa9247e1dc652024-08-27Verified
Maine State AGbd_aba5469c28c24dee2024-08-27Candidate

Name: Cipriani
norm: cipriani
Domain: cipriani.com

Name: Ongoing Operations
norm: ongoing operations
Industry: Financial ServicesllmTechnologyllm

Discovered: Jul 18, 2024
Breach occurred: Nov 13, 2023 – Nov 26, 2023
Undetected for: 248 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 31, 2024
Affected individuals: 1state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged third- party specialists to assist with determining the nature and scope of the incident
A thorough review of the contents of the impacted data was performed by FedComp, LLC
Began working with FedComp and Mountain Valley Federal Credit Union to locate address information for, and to notify, potentially impacted individuals
Provided written notice of this incident to the potentially impacted New Hampshire residents via First Class Mail on July 31, 2024
Offering ... of complimentary credit monitoring and identity protection services
Changes made: Implemented additional technical safeguards to further enhance the security of information in our possession and to prevent similar incidents from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGAug 27 · first

Maine State AGAug 27 · first

New Hampshire State AGAug 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ongoing-operations-20240827.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2024
Raw hash: c058441bccdddfe44bc9b3153d891797eadea1a69dee9b8e2d09f64dfe378259

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCipriani

Victim entityOngoing Operations

Incidentdiscovered Jul 18, 2024

Stated responseEngaged third- party specialists to assist with determining the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov