AccidentalOtherMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)EmploymentMediumContained

The Painted Turtle

bd_aeccf93dff059502 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 12, 2015

Filed

Mar 5, 2015

To disclose

7 weeks

Affected

1state residents only

Linked

3 filings

Confidence

67%

Full breach record for The Painted Turtle →

The Painted Turtle, a non-profit organization, notified the NH Attorney General of a privacy incident affecting 1 NH resident. An error in the online application database allowed a volunteer's personal information (including SSN, DL, medical info) to be viewable by another listed reference. Discovered Jan 12, 2015. Database was taken offline and code updated. Notification mailed March 6, 2015.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 52 days

Jan 12, 2015

Discovered

Mar 5, 2015

Filed

vs. sector median

1 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_ba2eeabdd1e1f40d2015-03-10 · +5dVerified
California State AGbd_eb7b0a093e7828832015-03-11 · +6dCandidate

Name: ID Experts
norm: id experts

Name: The Painted Turtle
norm: the painted turtle
Industry: Otherllm

Discovered: Jan 12, 2015
Materiality determined: —
Notification sent: Mar 6, 2015
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Employment
Data elements: Social Security numberMedical information
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Notified New Hampshire Attorney General's Office

During the incident: Brought the database offline to prevent anyone from being able to access the affected records
Updated their database’s code to prevent the issue from occurring again
Provided a one-year membership in ID Expert’s identity theft protection and restoration program
Changes made: Updated their database’s code to prevent the issue from occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 5 · first · this page

Massachusetts State AG+5d

California State AG+6d

Pattern: first filing Mar 5 (NH), last Mar 11 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/painted-turtle-20150305.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 5, 2015
Raw hash: 0e70f0ef224ab075444ade035cb777af244da248984648704b2be2f31d303b52

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityID Experts

Victim entityThe Painted Turtle

Incidentdiscovered Jan 12, 2015

Stated responseBrought the database offline to prevent anyone from being able to access the affected records

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov