MisuseManufacturingManufacturingPrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Alin Machining Company Inc

bd_bac117a83707fb31 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 10, 2014

Filed

Jan 12, 2015

To disclose

5 weeks

Affected · nationwide

71 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Alin Machining Company Inc →

Alin Machining Company Inc (dba Power Plant Services) notified the NH AG of an insider threat incident involving an independent contractor who misused employee credentials to access the HRIS system. The incident affected 7 employees (1 NH resident) between Nov 7 and Dec 4, 2014. Data exposed included names, addresses, SSNs, and bank account numbers. The company engaged law enforcement and is reviewing access protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 33 days

discovery → filing · 5 weeks / 33 days

Nov 7, 2014

Begins

Dec 10, 2014

Discovered

Jan 12, 2015

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_ea8fb16c612b53c22015-01-12Verified

Name: Alin Machining Company Inc
norm: alin machining

Name: Alin Machining Company Inc
norm: alin machining
Also named: Alin Machining Company Incdba oflegal entity
Power Plant Servicesdba oftrade name
Industry: Manufacturingllm

Discovered: Dec 10, 2014
Breach occurred: Nov 7, 2014 – Dec 4, 2014
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 13, 2015
Affected individuals: 7state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Launched an internal investigation
Notified and is working with law enforcement—both state and federal
Contacted affected individuals
Changes made: Reviewing its hiring policies
Reviewing use of independent contractors
Reviewing third-party companies that it utilizes
Retained individuals with respect to user access privileges and protection of user IDs and passwords
Reviewing its employee data access process with the goal of implementing more stringent access protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 12 · first

New Hampshire State AGJan 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/alin-machining-20150112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2015
Raw hash: 8453af3492c1c9672b7476a9bf6c12368ec3d7539ed70eadb8610e1f47ecdbf4

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAlin Machining Company Inc

Victim entityAlin Machining Company Inc

Incidentdiscovered Dec 10, 2014

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov