MalwareProfessional ServicesProfessional ServicesRansomwarePhishingData EncryptedRansom DemandedEmployee Data InvolvedCustomer Data InvolvedGovernment IDFinancial accountIdentity (basic)MediumContained

ExecuPharm Inc.

bd_dcfeb26245f9198d · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 17, 2020

To disclose

—

Affected

9state residents only

Linked

5 filings

Confidence

66%

Full breach record for ExecuPharm Inc. →

ExecuPharm, Inc. experienced a ransomware incident on March 13, 2020, initiated via phishing emails. Unknown individuals encrypted servers and demanded ransom. The incident potentially impacted 9 New Hampshire residents, exposing personal information including SSNs, driver's license numbers, and financial account details. ExecuPharm contained the incident, restored systems from backups, implemented MFA and endpoint protection, and offered one year of identity monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Mar 13, 2020

Begins

Apr 17, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_acab60010fa7e5572020-03-13 · +35dVerified by operator

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_f96df19d63ead0bd2020-04-17Verified by operator
Massachusetts State AGbd_4ea2294527b6a2902020-04-16 · +1dVerified by operator
Montana State AGbd_a8470fac8c8d843f2020-03-16 · +32dVerified

Name: ExecuPharm, Inc.
norm: execupharm
Domain: klgates.com

Name: ExecuPharm Inc.
norm: execupharm
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Mar 13, 2020
Materiality determined: —
Notification sent: Apr 17, 2020
Affected individuals: 9state-resident count only
Data types: Government IDFinancial accountIdentity (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1566.002 Spearphishing LinkT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified federal and local law enforcement authorities
Initial access: phishing_link

During the incident: Notified federal and local law enforcement authorities
Retained leading third party cybersecurity firms to investigate
Rebuilt the impacted servers from backup servers
Installed forensic tools on all systems
Isolated impacted systems until secure
Implemented additional countermeasures to block further ransomware emails
Secured the services of Kroll to provide identity monitoring at no cost for one year
Changes made: Fully restored and secured the ExecuPharm systems
Upgraded security measures to prevent future attacks
Implemented forced password resets
Implemented multi-factor authentication for remote access
Deployed endpoint protection, detection, and response tools
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMar 16 · first

Massachusetts State AG+31d

Indiana State AG+32d

New Hampshire State AG+32d · this page

Pattern: first filing Mar 16 (MT), last Apr 17 (NH) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/execupharm-20200417.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2020
Raw hash: 5927f793a1bd13a7ea60cf739888611a4038eb67c981b000a165fd0c80c5a5d2

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityExecuPharm, Inc.

Victim entityExecuPharm Inc.

IncidentRansomware

Stated responseNotified federal and local law enforcement authorities

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov