HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Spinnaker Management Group, LLC

bd_d23fc9ba915c424e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 13, 2020

Filed

Jan 29, 2021

To disclose

11 weeks

Affected

15state residents only

Linked

4 filings

Confidence

66%

Full breach record for Spinnaker Management Group, LLC →

Spinnaker Management Group, LLC notified the New Hampshire Attorney General of a data event affecting 15 NH residents. Unauthorized access to an email account occurred between Oct 6 and Nov 12, 2020. The company discovered suspicious activity on Nov 13, 2020, and confirmed impacted individuals on Dec 31, 2020. Names and SSNs were potentially accessed. Spinnaker implemented MFA, provided 24 months of credit monitoring, and issued notices starting Jan 14, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 38 days

discovery → filing · 11 weeks / 77 days

Oct 6, 2020

Begins

Nov 13, 2020

Discovered

Jan 29, 2021

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_22309b50298e1e442021-01-14 · +15dVerified
Maine State AGbd_6fa72211ffa0116b2021-01-14 · +15dCandidate
Indiana State AGbd_ab6320e6ce4104e82021-01-14 · +15dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Spinnaker Management Group, LLC
norm: spinnaker management
Industry: Financial Servicesllm

Discovered: Nov 13, 2020
Breach occurred: Oct 6, 2020 – Nov 12, 2020
Undetected for: 38 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 14, 2021
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Launched an investigation, with the assistance of its third-party IT support team
Instituted multi-factor authentication ("MFA") for its Microsoft accounts
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for 24 months through Epiq
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Instituted multi-factor authentication ("MFA") for its Microsoft accounts
Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJan 14 · first

Maine State AGJan 14 · first

Indiana State AGJan 14 · first

New Hampshire State AG+15d · this page

Pattern: first filing Jan 14 (MA), last Jan 29 (NH) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/spinnaker-management-20210129.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2021
Raw hash: 7401c629c7c368063b5dfccabbcbd7d37284dc393227f8cb40c12b3dbc1eb9b1

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entitySpinnaker Management Group, LLC

Incidentdiscovered Nov 13, 2020

Stated responseLaunched an investigation, with the assistance of its third-party IT support team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov