HackingGovernmentFinancial ServicesGovernmentStolen CredentialsBECTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Financial accountGovernment IDMediumContained

New Hampshire Retirement System

bd_bcc3e27574422c1b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 21, 2017

Filed

Aug 9, 2017

To disclose

19 days

Affected · nationwide

4543 in this filing

Confidence

64%

Full breach record for New Hampshire Retirement System →2 incidents on file

New Hampshire Retirement System (NHRS) notified the NH Attorney General on August 9, 2017, of a data security incident affecting 45 retirees. An unauthorized party established fraudulent online accounts in the NHRS 'My Account' portal in early July 2017 to redirect pension payments to Green Dot Bank accounts. NHRS detected the fraud before payments were processed, shutting down the function and deactivating the accounts. Affected data included bank account numbers, names, addresses, DOBs, and last 4 digits of SSNs. No pension funds were lost. NHRS reported to the Secret Service and NH State Police, offered credit monitoring, and implemented stricter authentication controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 20 days

discovery → filing · 19 days

Jul 1, 2017

Begins

Jul 21, 2017

Discovered

Aug 9, 2017

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed45 affectedView incident

Name: MCLANE MIDDLETON, PROFESSIONAL ASSOCIATION
norm: mclane middleton professional

Name: New Hampshire Retirement System
norm: new hampshire retirement system
Industry: GovernmentllmFinancial Servicesllm

Discovered: Jul 21, 2017
Breach occurred: Jul 1, 2017 – Jul 21, 2017
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 25, 2017
Affected individuals: 45state + nationwide
Data types: Identity (basic)Financial accountGovernment ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's officeNotified United States Secret ServiceNotified New Hampshire State Police
Initial access: valid_credentials

During the incident: Immediately reported the incident verbally to the paralegal in the Attorney General's office and to Robert Adams in the Financial Crimes Division
Reported the incident to appropriate Special Agents at the United States Secret Service and to the New Hampshire State Police
Shut down the My Account function to prevent any continued unauthorized access
Deactivated the fraudulently created My Accounts
Terminated any fraudulently created electronic direct deposit instructions
Issued July pension payments for the affected retirees via paper checks sent through U.S. Mail
Contacted Green Dot Bank and facilitated the closure of the fraudulently created Green Dot Bank accounts
Advised affected individuals to notify their banks and initiate a fraud alert
Retained legal counsel to investigate and advise
Retained a computer forensic firm, Charles River Associates, to assist with the investigation
Changes made: Offered to reimburse the retirees for the cost of any credit freeze
Pre-paid for two years of credit monitoring for all affected retirees
Posted a notice on its website about the incident
Sent a further email newsletter to its subscriber list of over 40,000 members, retirees and other stakeholders
Implemented stricter authentication controls for establishing My Accounts
Working with counsel and forensic company to identify other potentially appropriate remediation and data security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nh-retirement-system-20170809.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 9, 2017
Raw hash: ddc8ee8e4760af426626a539a8b76e55f56feef54ebd2eaaf4f91d543267ee9c

Reporting entityMCLANE MIDDLETON, PROFESSIONAL ASSOCIATION

Victim entityNew Hampshire Retirement System

Incidentdiscovered Jul 21, 2017

Stated responseImmediately reported the incident verbally to the paralegal in the Attorney General's office and to Robert Adams in the Financial Crimes Division

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov