HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedData ExfiltratedGovernment IDIdentity (basic)Financial accountMediumContained

Retirement Consultant Services

bd_bd3dea711a65a5fd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 24, 2020

Filed

May 4, 2021

To disclose

32 weeks

Affected

1state residents only

Linked

4 filings

Confidence

67%

Full breach record for Retirement Consultant Services →

Retirement Consultant Services (RCS) notified the New Hampshire Attorney General of a data security incident. On September 24, 2020, RCS discovered suspicious activity in its email system. An investigation determined an unauthorized individual accessed an email account containing Social Security numbers, dates of birth, and financial account information. One New Hampshire resident was affected. RCS engaged forensic experts, enhanced network security, increased password complexity, and provided 12 months of credit/identity monitoring through IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 weeks / 222 days

Sep 24, 2020

Discovered

May 4, 2021

Filed

vs. sector median

+23 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_0afc0bc535a6eed52021-05-05 · +1dVerified
Indiana State AGbd_a2d10631f40d7c472021-05-03 · +1dVerified
Massachusetts State AGbd_f6ab0c81606a23932021-05-07 · +3dVerified

Name: Retirement Consultant Services
norm: retirement consultant

Name: Retirement Consultant Services
norm: retirement consultant
Industry: Financial Servicesllm

Discovered: Sep 24, 2020
Materiality determined: —
Notification sent: May 3, 2021
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Engaged a digital forensics firm to investigate the cause and scope of the incident
Secured the services of IDX to provide identity monitoring
Offered credit and CyberScan monitoring
Offered a $1,000,000 insurance reimbursement policy
Offered fully managed identity theft recovery services for 12 months
Working with leading cybersecurity experts to enhance the security of its network
Increasing its password complexity requirements
Changes made: Working with leading cybersecurity experts to enhance the security of its network
Increasing its password complexity requirements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(222 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 3 · first

New Hampshire State AG+1d · this page

Maine State AG+2d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/retirement-consultant-services-20210504.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 4, 2021
Raw hash: e2ee6cc1bce97e547e830c218f94b0efd3bcdc9050f9a3212fdd33e4f3446aca

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRetirement Consultant Services

Victim entityRetirement Consultant Services

Incidentdiscovered Sep 24, 2020

Stated responseEngaged a digital forensics firm to investigate the cause and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov