Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedIdentity (basic)CredentialsLowContained

James E. Hanson Management Company, Inc.

bd_d29615caf42bfebd · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 17, 2021

Filed

Feb 8, 2022

To disclose

25 weeks

Affected

1state residents only

Linked

3 filings

Confidence

65%

Full breach record for James E. Hanson Management Company, Inc. →

James E. Hanson Management Company, Inc. notified individuals of unauthorized access to employee email accounts between July 1 and August 19, 2021, discovered on August 17, 2021. The incident involved compromised credentials likely via phishing. Impacted data included names and potentially other identity information. The company engaged forensic investigators and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 47 days

discovery → filing · 25 weeks / 175 days

Jul 1, 2021

Begins

Aug 17, 2021

Discovered

Feb 8, 2022

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_3fe17b6ac93ec2162022-02-08Verified
New Hampshire State AGbd_4ebdcdb7855b6f092022-02-14 · +6dVerified

Name: James E. Hanson Management Company, Inc.
norm: james e hanson management

Name: James E. Hanson Management Company, Inc.
norm: james e hanson management
Industry: Professional Servicesllm

Discovered: Aug 17, 2021
Breach occurred: Jul 1, 2021 – Aug 19, 2021
Undetected for: 47 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 8, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Credentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: notify applicable regulatory authorities, as required by law
Initial access: phishing_link

During the incident: Took steps to secure the email accounts
Launched an investigation which included working with a third-party forensic investigator
Completed a programmatic and manual review of the contents of the email accounts
Notifying impacted individuals associated with that sensitive information
Offering complimentary access to credit monitoring services through Experian
Changes made: Reviewing our policies procedures and processes related to the storage and access of information
Additional workforce training is being conducted to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(175 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGFeb 8 · first

Montana State AGFeb 8 · first · this page

New Hampshire State AG+6d

Pattern: first filing Feb 8 (MA), last Feb 14 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/James-E.-Hanson-Management-Company-Inc.-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 8, 2022
Raw hash: 8e462057e886eca71d15ac5c67fcaeed43be3d369b5bcfb11b702d8d3a9e6874

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityJames E. Hanson Management Company, Inc.

Victim entityJames E. Hanson Management Company, Inc.

Incidentdiscovered Aug 17, 2021

Stated responseTook steps to secure the email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov