HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Universal Automation & Mechanical Services, Inc.

bd_b2b763db83d27ca8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2020

Filed

Nov 23, 2020

To disclose

8 weeks

Affected

5state residents only

Linked

2 filings

Confidence

66%

Full breach record for Universal Automation & Mechanical Services, Inc. →

Universal Automation & Mechanical Services, Inc. notified the NH Attorney General of a data security incident involving unauthorized access to a company email account. The access occurred on or about July 14, 2020, but was not discovered until September 29, 2020, when the company learned that personal information of five New Hampshire residents was contained in the account. Affected data may include names, Social Security numbers, and financial account information. The company engaged forensic investigators, secured the email system, implemented MFA, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 77 days

discovery → filing · 8 weeks / 55 days

Jul 14, 2020

Begins

Sep 29, 2020

Discovered

Nov 23, 2020

Filed

vs. sector median

10 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_1ff2d3819ce9e5f42020-11-26 · +3dVerified

Name: Universal Automation & Mechanical Services, Inc.
norm: universal automation mechanical services

Name: Universal Automation & Mechanical Services, Inc.
norm: universal automation mechanical
Industry: Professional Servicesllm

Discovered: Sep 29, 2020
Breach occurred: Jul 14, 2020
Undetected for: 77 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2020
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Immediately began an investigation and took steps to secure its email system
Engaged an independent digital forensics firm to determine what happened
Commenced a thorough review of the contents of the identified account
Mandating password resets
Implementing multi-factor authentication for all user accounts
Enabling unified audit logging features to detect any future suspicious activity
Requested the assistance of the digital forensics firm to implement a program for regulating and prohibiting the email transmission of any unsecured sensitive or personal information
Offered complimentary credit monitoring and identity theft protection services through IDX
Changes made: Mandating password resets
Implementing multi-factor authentication for all user accounts within its environment
Enabling unified audit logging features to detect any future suspicious activity within its email environment
Implementing a program for regulating and prohibiting the email transmission of any unsecured sensitive or personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGNov 23 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/universal-automation-mechanical-services-20201123.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 23, 2020
Raw hash: a495d70135972e7f60068d43cb0234b170ba8f17267789cecaf29f8efd293b6d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUniversal Automation & Mechanical Services, Inc.

Victim entityUniversal Automation & Mechanical Services, Inc.

Incidentdiscovered Sep 29, 2020

Stated responseImmediately began an investigation and took steps to secure its email system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov