HackingEnergy & UtilitiesUtilitiesStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

MASSACHUSETTS MUNICIPAL WHOLESALE ELECTRIC CO.

bd_aeeed58579718a99 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 2, 2025

Filed

Jul 21, 2025

To disclose

24 weeks

Affected

3state residents only

Linked

5 filings

Confidence

65%

Full breach record for MASSACHUSETTS MUNICIPAL WHOLESALE ELECTRIC CO. →

Massachusetts Municipal Wholesale Electric Company (MMWEC) notified the NH AG of a data event affecting 3 NH residents. Unauthorized access occurred Jan 25–Feb 3, 2025. Data exposed: names, SSNs/TINs, financial account info. MMWEC discovered suspicious activity on Feb 2, 2025, engaged law enforcement, and offered 24 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d24 weeks discovery → filing

Incident timeline

undetected · 8 days

discovery → filing · 24 weeks / 169 days

Jan 25, 2025

Begins

Feb 2, 2025

Discovered

Jun 10, 2025

Scope determined

Jul 21, 2025

Filed

This filing is one of 5 about the same incident.View merged incident

A leak claim by blacksuit about this victim predates this filing by 169 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteblacksuitbd_6b9705041b17d58f2025-02-04 · +167dVerified by operator
Leak Siteblacksuitbd_35040778da5bb0aa2025-02-02 · +169dVerified by operator

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_9100a37d91cd6d4f2025-07-21Candidate
Massachusetts State AGbd_d70bf31261083a642025-07-21Verified by operator

Name: MASSACHUSETTS MUNICIPAL WHOLESALE ELECTRIC CO.
norm: massachusetts municipal wholesale electric
Domain: mmwec.org

Name: MASSACHUSETTS MUNICIPAL WHOLESALE ELECTRIC CO.
norm: massachusetts municipal wholesale electric
Domain: mmwec.org
Industry: Energy & Utilitiesllm

Discovered: Feb 2, 2025
Breach occurred: Jan 25, 2025 – Feb 3, 2025
Undetected for: 8 daysoccurrence → discovery
Materiality determined: Jun 10, 2025
Notification sent: Jul 21, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcementProviding written notice to relevant state regulators
Initial access: valid_credentials

During the incident: Took steps to secure its environment
Launched an investigation
Reviewed relevant files to identify individuals with personal information
Notified federal law enforcement
Provided written notice to affected individuals
Provided access to monitoring and identity restoration services through Experian for twenty-four (24) months
Changes made: Implementing additional safeguards and training to its employees
Reviewing policies, procedures and processes related to the storage and access of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJul 21 · first

Massachusetts State AGJul 21 · first

New Hampshire State AGJul 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/massachusetts-municipal-wholesale-electric-20250721.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2025
Raw hash: b0451a46013b43f320821f22f615e19f21119678fc017b18b5d51f20662dc97a

Linked disclosures

Ransomware claims (2)

Regulatory filings (2) · sorted by filing gap

Reporting entityMASSACHUSETTS MUNICIPAL WHOLESALE ELECTRIC CO.

Victim entityMASSACHUSETTS MUNICIPAL WHOLESALE ELECTRIC CO.

Incidentdiscovered Feb 2, 2025

Stated responseTook steps to secure its environment

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov