HackingTechnologyInformationSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancialMediumContained

DecisionDesk, Inc.

bd_df2957abb70e9adf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2013

Filed

Dec 10, 2013

To disclose

6 weeks

Affected

28state residents only

Linked

2 filings

Confidence

66%

Full breach record for DecisionDesk, Inc. →2 incidents on file

DecisionDesk, Inc. notified the NH AG of a breach involving its hosting provider, MongoHQ. Unauthorized access occurred on or about Oct 28, 2013. MongoHQ discovered the intrusion on Nov 1, 2013. DecisionDesk reset passwords and notified 28 NH residents on Dec 6, 2013. Data included PII and SSNs for 9 residents; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 6 weeks / 39 days

Oct 28, 2013

Begins

Nov 1, 2013

Discovered

Dec 10, 2013

Filed

vs. sector median

13 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_c2e793b5ab1f626e2013-12-10Candidate

Name: Thompson Hine LLP
norm: thompson hine

Name: DecisionDesk, Inc.
norm: decisiondesk
Industry: Technologyllm

Discovered: Nov 1, 2013
Breach occurred: Oct 28, 2013
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 6, 2013
Affected individuals: 28state-resident count only
Data types: Identity (basic)Government IDFinancial
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Third party: via MongoHQ
Initial access: supply_chain

During the incident: Resetting all passwords
Monitoring MongoHQ's remediation of the incident
Changes made: Offering one year of credit monitoring services to those residents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGDec 10 · first

New Hampshire State AGDec 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/decisiondesk-20131210.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 10, 2013
Raw hash: dac5bb69d93f43ad42204641baef2e14dac944248a71b674ab1fd0df0a2c3686

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityThompson Hine LLP

Victim entityDecisionDesk, Inc.

Incidentdiscovered Nov 1, 2013

Stated responseResetting all passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov