HackingFinancial ServicesFinanceStolen CredentialsTargetedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

CNU of New Hampshire, LLC

bd_b97064310a42342c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 23, 2018

Filed

Apr 23, 2018

To disclose

4 weeks

Affected

9state residents only

Confidence

67%

Full breach record for CNU of New Hampshire, LLC →

CNU of New Hampshire, LLC dba CashNetUSA notified the NH AG that an unauthorized party used valid credentials to access 9 NH resident accounts starting March 23, 2018. Attackers viewed PII, bank info, and partial SSN/Driver's License. CashNetUSA disabled passwords and required resets.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 31 days

Mar 23, 2018

Discovered

Apr 23, 2018

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident

Name: CNU of New Hampshire, LLC
norm: cnu of new hampshire

Name: CNU of New Hampshire, LLC
norm: cnu of new hampshire
Industry: Financial Servicesllm

Discovered: Mar 23, 2018
Materiality determined: —
Notification sent: Apr 27, 2018
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Restricted access to the online accounts that it believes were affected
Disabled the current passwords
Required account holders to reset their passwords
Continuing to monitor these accounts for suspicious activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cnu-20180423.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 23, 2018
Raw hash: 3e9eb2a796f0fe3c5931c7a45028d0065656cd4bfece61099252871dcde580d3

Reporting entityCNU of New Hampshire, LLC

Victim entityCNU of New Hampshire, LLC

Incidentdiscovered Mar 23, 2018

Stated responseRestricted access to the online accounts that it believes were affected

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov