Social EngineeringProfessional ServicesProfessional ServicesPhishingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Igoe

bd_cfc4291435540310 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 11, 2020

Filed

Mar 2, 2021

To disclose

51 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Igoe →

Igoe & Company Incorporated, an employee benefits administrator, notified the New Hampshire Attorney General of a data event affecting one NH resident. Unauthorized access to a business partner's email account occurred between Feb 25 and Mar 11, 2020. The email contained names and Social Security numbers. Igoe engaged forensic specialists, reviewed the account, and provided one year of credit monitoring to the affected individual. Remediation included enhanced security training, MFA, and email security upgrades.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 51 weeks / 356 days

Feb 25, 2020

Begins

Mar 11, 2020

Discovered

Mar 2, 2021

Filed

vs. sector median

+32 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_47da67d0358aedfd2021-02-25 · +5dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Igoe
norm: igoe
Domain: goigoe.com
Industry: Professional Servicesllm

Discovered: Mar 11, 2020
Breach occurred: Feb 25, 2020 – Mar 11, 2020
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 25, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Began an investigation, with the assistance of third-party computer forensics specialists
Engaged in a comprehensive programmatic and manual review of the entire contents of the email account
Provided potentially impacted individuals with access to credit monitoring and identity theft protection services for one year through TransUnion
Provided potentially impacted individuals with information on how to place a fraud alert and security freeze on one's credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Encouraged to contact the Federal Trade Commission, their state Attorney General, and law enforcement
Changes made: Reviewed existing security policies and implemented additional security measures
Enhancing security training regarding phishing attacks
Upgrading its email environment to include additional logging and security features
Incorporating conditional access to restrict email account access to internal resources only
Automatic enforcement of multi-factor authentication for any exception for the internal conditional access restriction
Enabling geo-blocking
Adding warning labels to emails from external sources
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 51 weeks(356 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGFeb 25 · first

New Hampshire State AG+5d · this page

Pattern: first filing Feb 25 (MA), last Mar 2 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/igoe-company-20210302.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2021
Raw hash: 97b16f241a42c83fa9243c8bbbe4f296fddab4e1df4f91a1fa58c9bd4e197312

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityIgoe

Incidentdiscovered Mar 11, 2020

Stated responseBegan an investigation, with the assistance of third-party computer forensics specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov