HackingManufacturingManufacturingStolen CredentialsTargetedIdentity (basic)Government IDMediumContained

Columbia Forest Products

bd_c591cb202b5c3ca0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 22, 2018

Filed

Apr 10, 2019

To disclose

24 weeks

Affected

2state residents only

Linked

2 filings

Confidence

67%

Full breach record for Columbia Forest Products →

Columbia Forest Products notified the NH AG of a security incident discovered Oct 22, 2018, where an unauthorized individual accessed an employee email and Finance directory using compromised credentials. Two NH residents' names and SSNs were potentially exposed. CFP reset credentials, conducted forensic investigation, and provided 2 years of credit monitoring via IDShield.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 170 days

Oct 22, 2018

Discovered

Apr 10, 2019

Filed

vs. sector median

+14 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_91a0b8e7059a367a2019-03-29 · +12dCandidate

Name: Columbia Forest Products
norm: columbia forest products

Name: Columbia Forest Products
norm: columbia forest products
Industry: Manufacturingllm

Discovered: Oct 22, 2018
Materiality determined: —
Notification sent: Mar 29, 2019
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Initiated an investigation
Reset the log-in credential for the email account and directory
Conducted a thorough forensic investigation
Implemented enhanced security measures to further protect employee data
Providing two years of credit monitoring and identity restoration services to potentially affected employees through IDShield
Changes made: Implemented enhanced security measures to further protect employee data
Implemented additional security controls to further protect your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(170 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGMar 29 · first

New Hampshire State AG+12d · this page

Pattern: first filing Mar 29 (OR), last Apr 10 (NH) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/columbia-forest-products-20190401.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2019
Raw hash: 05be8b2876f40c34be8ff6dc87a554be67de22e27741d04f7129bd8e8d34d587

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityColumbia Forest Products

Victim entityColumbia Forest Products

Incidentdiscovered Oct 22, 2018

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov