HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDEmploymentMediumContained

Automotive Services Network, Inc.

bd_c8fbfa5e32c7cd60 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2022

Filed

Jan 24, 2023

To disclose

8 weeks

Affected

3state residents only

Linked

5 filings

Confidence

67%

Full breach record for Automotive Services Network, Inc. →

Automotive Services Network, Inc. (ASN) notified the NH AG that on Nov 30, 2022, an unauthorized party accessed a personnel database containing names, SSNs, and employment data. 3 NH residents were affected. ASN terminated access, upgraded EDR, engaged a SOC, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 55 days

Nov 30, 2022

Discovered

Jan 24, 2023

Filed

vs. sector median

10 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_a06e175f5ba603582023-01-18 · +6dVerified
Maine State AGbd_c304c873ad06a41d2023-01-18 · +6dVerified
Indiana State AGbd_a6a6e846b3020d8a2023-01-17 · +7dVerified
Maine State AGbd_e309b54842a1d1042023-01-13 · +11dCandidate

Name: Maynard Cooper Gale
norm: maynard cooper gale

Name: Automotive Services Network, Inc.
norm: automotive services network
Industry: Professional Servicesllm

Discovered: Nov 30, 2022
Materiality determined: —
Notification sent: Jan 17, 2023
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Terminated the unauthorized party’s access to the network
Upgraded its endpoint detection and response (“EDR”) product
Engaged a third party security operations center (“SOC”)
Moving all personnel records to a more secure, cloud-based storage environment
Offered two (2) years of complimentary credit monitoring and identity protection services
Changes made: Engaged a third-party security operations center to continuously monitor our systems
Moving all personnel records to a more secure storage environment
Strengthening the cyber-resiliency of the environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Maine State AGJan 13 · first

Indiana State AG+4d

Massachusetts State AG+5d

Maine State AG+5d

New Hampshire State AG+11d · this page

Pattern: first filing Jan 13 (ME), last Jan 24 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/automotive-services-network-20230124.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2023
Raw hash: 79da5944971611d78a78d4ac16e8d9ae31e36945d52d819f74626126ed822b06

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMaynard Cooper Gale

Victim entityAutomotive Services Network, Inc.

Incidentdiscovered Nov 30, 2022

Stated responseTerminated the unauthorized party’s access to the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov