MalwareTechnologyInformationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)EmploymentMediumContained

BOSE CORPORATION

bd_d9c176d5e31f6593 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 7, 2021

Filed

May 19, 2021

To disclose

10 weeks

Affected

6state residents only

Linked

4 filings

Confidence

67%

Full breach record for BOSE CORPORATION →

Bose Corporation notified the New Hampshire Attorney General of a ransomware incident detected on March 7, 2021. The attack affected internal HR files, potentially exposing the names, Social Security Numbers, and compensation data of 6 former New Hampshire employees. Bose engaged forensic experts and the FBI, contained the threat, and provided 12 months of identity protection services to affected individuals. Notification letters were sent on May 19, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 73 days

Mar 7, 2021

Discovered

May 19, 2021

Filed

vs. sector median

8 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_6e6d02116ed7d1dc2021-05-19Verified
Maine State AGbd_c6f8b9a8acd1e4bd2021-05-19Candidate
Massachusetts State AGbd_ce957c4199a5ecf02021-05-19Verified

Name: BOSE CORPORATION
norm: bose

Name: BOSE CORPORATION
norm: bose
Industry: Technologyllm

Discovered: Mar 7, 2021
Materiality determined: —
Notification sent: May 19, 2021
Affected individuals: 6state-resident count only
Data types: Government IDIdentity (basic)Employment
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Attorney General of New Hampshireworking with the U.S. Federal Bureau of Investigation

During the incident: Initiated incident response protocols
Activated its technical team to contain the incident
Hardened its defenses against unauthorized activity
Engaged expert third-party forensics providers
Worked with its cyber experts to bring its systems back online
Engaged experts to monitor the dark web
Working with the U.S. Federal Bureau of Investigation
Changed passwords for all end users and privileged users
Changed access keys for all service accounts
Changes made: Enhanced malware/ransomware protection on endpoints and servers
Performed detailed forensics analysis on impacted server
Blocked the malicious files used during the attack on endpoints
Enhanced monitoring and logging to identify any future actions
Blocked newly identified malicious sites and IPs linked to this threat actor on external firewalls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 19 · first

Maine State AGMay 19 · first

Massachusetts State AGMay 19 · first

New Hampshire State AGMay 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bose-20210519.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 19, 2021
Raw hash: 4ea2e5e9374d2fdfabc02840153b047a7d74110fad907313e7310cefef61fe7b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBOSE CORPORATION

Victim entityBOSE CORPORATION

Incidentdiscovered Mar 7, 2021

Stated responseInitiated incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov