HackingOtherData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Air T, Inc.

bd_cc05efcbf7d1b241 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 30, 2022

Filed

Feb 3, 2023

To disclose

40 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Air T, Inc. →

Air T, Inc. notified the NH AG of a data event affecting 2 NH residents. Unauthorized access occurred between April 17-30, 2022. Data included names, SSNs, financial accounts, DOB, medical/health insurance info. Notification sent Jan 30, 2023. Law enforcement notified; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 13 days

discovery → filing · 40 weeks / 279 days

Apr 17, 2022

Begins

Apr 30, 2022

Discovered

Feb 3, 2023

Filed

vs. sector median

+34 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_0242a64441293d9b2023-01-30 · +4dVerified
Massachusetts State AGbd_06c2ab2b3d40cb672023-01-30 · +4dVerified
Montana State AGbd_97d87fccc71832622023-01-30 · +4dCandidate
Maine State AGbd_bd93e4fdff8c70092023-01-30 · +4dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Air T, Inc.
norm: air t
Industry: Otherllm

Discovered: Apr 30, 2022
Breach occurred: Apr 17, 2022 – Apr 30, 2022
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 30, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified federal law enforcement

During the incident: Took steps to secure its network and minimize any disruption to its operations
Launched an investigation into the nature and scope of the incident with the assistance of industry-leading cybersecurity specialists
Notified federal law enforcement regarding the event
Provided access to credit monitoring services for twelve (12) months, through Experian to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Working to implement additional safeguards and training to its employees
Deployment of an advanced threat protection and monitoring tool
Reviewing existing security policies and implemented additional cybersecurity measures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(279 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 30 · first

Massachusetts State AGJan 30 · first

Montana State AGJan 30 · first

Maine State AGJan 30 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ait-t-20230203.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2023
Raw hash: 44026c82f1ceaa792b5286fc4d66fa04971671199f61e8b2a90b152779c57c51

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityAir T, Inc.

Incidentdiscovered Apr 30, 2022

Stated responseTook steps to secure its network and minimize any disruption to its operations

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov