HackingTechnologyFinancial ServicesInformationStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

NYDIG

bd_ccedfcccccadc649 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 7, 2021

Filed

Apr 30, 2021

To disclose

23 days

Affected · nationwide

5511 in this filing

Linked

3 filings

Confidence

65%

Full breach record for NYDIG →

NYDIG Execution LLC and NYDIG Trust Company LLC reported a data security incident involving third-party vendor LogicGate, Inc. An unauthorized third party accessed and decrypted a backup file in LogicGate's Risk Cloud environment on February 23, 2021. The backup contained customer information including names, SSNs, bank account numbers, and passport/driver's license numbers. Approximately 551 individuals were affected, including 1 New Hampshire resident. NYDIG notified the NH Attorney General on April 26, 2021, and began notifying affected individuals on April 9, 2021. NYDIG is offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 43 days

discovery → filing · 23 days

Feb 23, 2021

Begins

Apr 7, 2021

Discovered

Apr 30, 2021

Filed

vs. sector median

8 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_105a79200d13021e2021-04-28 · +2dVerified
Massachusetts State AGbd_e7d6385a90cc30882021-05-03 · +3dVerified

Name: Debevoise & Plimpton LLP
norm: debevoise plimpton

Name: NYDIG
norm: nydig
Domain: nydig.com
Industry: TechnologyllmFinancial Servicesllm

Discovered: Apr 7, 2021
Breach occurred: Feb 23, 2021
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 27, 2021
Affected individuals: 551state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General pursuant to N.H. Rev. Stat. Ann. § 359-C:20
Third party: via LogicGate, Inc.
Initial access: valid_credentials

During the incident: Sent informal notice of the incident by email to potentially affected individuals
Sending a formal notice to all potentially affected individuals by mail
Offering 24 months of free identity theft and credit monitoring services through Norton LifeLock
Conducted cybersecurity diligence on LogicGate before engaging them and before renewing services agreement
Enhancing security protocols around its systems
Raised awareness internally with its staff to be on heightened alert
Conducting dark web monitoring
Changes made: LogicGate deactivated and rotated credentials associated with its cloud computing platform
LogicGate enhanced its authentication requirements
LogicGate activated additional information security monitoring and alerting
LogicGate conducted a targeted third-party audit of its cloud environment
LogicGate commenced a more comprehensive assessment of the environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGApr 28 · first

New Hampshire State AG+2d · this page

Massachusetts State AG+5d

Pattern: first filing Apr 28 (IN), last May 3 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nydig-execution-nydig-trust-20210430.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 30, 2021
Raw hash: 8d5cbd6c89664a7b2bf625357adb2cf164d8584c2da727513dccce706bbfe2af

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDebevoise & Plimpton LLP

Victim entityNYDIG

Incidentdiscovered Apr 7, 2021

Stated responseSent informal notice of the incident by email to potentially affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov