MalwareGovernment IDIdentity (basic)Financial accountMediumContained

Moss

bd_d6c9341e30e07e2d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 20, 2020

Filed

Jan 19, 2021

To disclose

17 weeks

Affected

1state residents only

Linked

3 filings

Confidence

67%

Full breach record for Moss →

Moss, Inc. notified the NH Attorney General of a ransomware incident discovered on September 20, 2020. The attack resulted in the exfiltration of one New Hampshire resident's name, SSN, address, and credit card number. Notifications were mailed on January 13, 2021. The company engaged forensic consultants and law enforcement (FBI) and implemented additional security safeguards.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 121 days

Sep 20, 2020

Discovered

Jan 19, 2021

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_7ef33c73514342b42021-01-15 · +4dVerified
Indiana State AGbd_9230fa6e32f1bc732021-01-13 · +6dCandidate

Name: Moss
norm: moss
Domain: moss.com

Name: Moss
norm: moss
Domain: moss.com

Discovered: Sep 20, 2020
Materiality determined: —
Notification sent: Jan 13, 2021
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Engaged an expert cybersecurity consulting firm to launch a thorough investigation
Notified relevant law enforcement agencies, including the Federal Bureau of Investigation
Changes made: Working with expert cybersecurity consulting firms
Implemented additional solutions to further safeguard and monitor its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(121 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJan 13 · first

Massachusetts State AG+2d

New Hampshire State AG+6d · this page

Pattern: first filing Jan 13 (IN), last Jan 19 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/moss-20210119.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 19, 2021
Raw hash: fc54c2230e785919c34827ee9653e49674f1bb60211ccc08dc124a578d5bc373

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMoss

Victim entityMoss

Incidentdiscovered Sep 20, 2020

Stated responseEngaged an expert cybersecurity consulting firm to launch a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov