MalwareFinanceMount LockerPIIIdentity (basic)Financial accountLowActive

SN Servicing Corporation

bd_b8759a76ab97511d · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 15, 2020

Filed

Jan 15, 2021

To disclose

13 weeks

Affected

8state residents only

Linked

10 filings

Confidence

66%

Full breach record for SN Servicing Corporation →2 incidents on file

SN Servicing Corporation, a subsidiary of Security National Master Holding Company, LLC, disclosed a ransomware incident involving the Mount Locker threat actor. The attack occurred on or about October 14-15, 2020, and was discovered on October 15, 2020. The incident resulted in the exfiltration of borrower billing statements containing names, addresses, loan numbers, and balance information. At least 8 New Hampshire residents were affected. SN notified the FBI, engaged forensic investigators, and mailed notification letters on January 15, 2021. Remediation included upgrading security tools and blocking foreign traffic.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d13 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 13 weeks / 92 days

Oct 14, 2020

Begins

Oct 15, 2020

Discovered

Jan 15, 2021

Filed

This filing is one of 10 about the same incident.View merged incident

A leak claim by egregor about this victim predates this filing by 92 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteegregorbd_4bc6fb5649261ccf2020-10-15 · +92dVerified

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_62f5a428547a502d2021-01-15Verified by operator
Indiana State AGbd_c6e80a15fece44ed2021-01-15Verified by operator
California State AGbd_0424e3f59662bb0d2021-01-29 · +14dVerified
Illinois State AGbd_225df64f9dbda7ba2021-01-01 · +14dVerified by operator

Show 4 more filings ↓up to 192d gap

Maine State AGbd_376b6357c22f175f2021-07-16 · +182dVerified
Oregon State AGbd_d479dd57d0545f1f2021-07-16 · +182dVerified
California State AGbd_d772c960f49e9ed82021-07-16 · +182dVerified
South Carolina State AGbd_7b8b73c450e5945f2021-07-26 · +192dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: SN Servicing Corporation
norm: sn servicing

Discovered: Oct 15, 2020
Breach occurred: Oct 14, 2020 – Oct 15, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jan 15, 2021
Affected individuals: 8state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Ransomware· Mount Locker
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: Mount LockerExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau

During the incident: Notified the Federal Bureau of Investigation ("FBI")
Engaged a third-party cybersecurity forensics investigator
Hired a third-party e-discovery vendor to conduct a data mining review
Mailed incident notification letters addressed to the affected population on January 15, 2021, via First Class Mail
Changes made: Replacing email filtering tools, malware software, and Internet monitoring tools with more robust solutions that utilize artificial intelligence (AI) to detect and block known and newly introduced malware
Blocking all inbound and outbound internet, email, and network traffic to foreign countries
Upgrading infrastructure to improve backup and recovery efforts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(92 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+14d

Indiana State AG+14d

New Hampshire State AG+14d · this page

California State AG+28d

Maine State AG+196d

Oregon State AG+196d

California State AG+196d

South Carolina State AG+206d

Pattern: first filing Jan 1 (IL), last Jul 26 (SC) — a 206-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sn-servicing-20210115.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 15, 2021
Raw hash: 398216cac74c5328da3dd0dfa20e01dad070628e09edcf74b813effd4e798076

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entitySN Servicing Corporation

Incidentdiscovered Oct 15, 2020

Stated responseNotified the Federal Bureau of Investigation ("FBI")

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov