MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Boulos Asset Mgmt

bd_d0da4760cd70ca01 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 30, 2021

Filed

Jul 9, 2021

To disclose

14 weeks

Affected

3state residents only

Linked

2 filings

Confidence

67%

Full breach record for Boulos Asset Mgmt →

The Boulos Company notified the New Hampshire Attorney General on July 9, 2021, of a ransomware incident detected on March 30, 2021. An unauthorized party attempted to lock the company out of its network for financial payment. The company shut off network access and engaged forensic investigators. The investigation determined that the full name, mailing address, and Social Security number of three New Hampshire residents may have been compromised. No evidence of data misuse was found. The company notified the affected individuals on June 29, 2021, and offered 18 months of credit monitoring through Kroll. Remediation included MFA, updated security programs, and secure file transfer systems.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 101 days

Mar 30, 2021

Discovered

Jul 9, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_bbe2c968e04789492021-07-07 · +2dVerified

Name: Boulos Asset Mgmt
norm: boulos asset mgmt
Domain: boulospm.com

Name: Boulos Asset Mgmt
norm: boulos asset mgmt
Domain: boulospm.com
Industry: Professional Servicesllm

Discovered: Mar 30, 2021
Materiality determined: —
Notification sent: Jun 29, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Shut off all access to the network
Engaged a specialized third-party forensic incident response firm
Conducted an investigation into what files may have been accessed
Confirmed the security of our network environment
Working with law enforcement
Offered 18 months of free credit monitoring, fraud consultation and identity theft restoration services through Kroll
Changes made: Updating our written information security program
Adding multi-layered network protection
Adding security protocols for domain controllers and servers
Adding multi-factor authentication for network access
Removing clients’ ability to provide sensitive data in purchase and sale agreements and related transaction documents
Adding additional password protections for all files containing sensitive personal information
Implementing a new secure file transfer system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(101 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJul 7 · first

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/boulos-20210709.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2021
Raw hash: 8759bf62104a19229df03b9f6334af638d6201317f4c2d5c17883ccdc4d15342

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBoulos Asset Mgmt

Victim entityBoulos Asset Mgmt

Incidentdiscovered Mar 30, 2021

Stated responseShut off all access to the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov