HackingOtherStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountCredentialsMediumContained

Ashton Woods Homes

bd_e0814bb810b91545 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 21, 2019

Filed

Sep 30, 2019

To disclose

14 weeks

Affected · nationwide

1,9261 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Ashton Woods Homes →

Ashton Woods Homes notified the NH AG of unauthorized access to employee email accounts between April 8 and June 21, 2019. The incident potentially exposed one NH resident's name, financial account info, credit card numbers, and credentials. The company engaged a cyber security firm, secured accounts, and offered one year of credit monitoring. A total of 1,926 individuals were affected nationwide.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 74 days

discovery → filing · 14 weeks / 101 days

Apr 8, 2019

Begins

Jun 21, 2019

Discovered

Sep 30, 2019

Filed

vs. sector median

+7 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_c3bf3cd9b6c2705c2019-09-26 · +4dCandidate

Name: Ashton Woods Homes
norm: ashton woods homes

Name: Ashton Woods Homes
norm: ashton woods homes
Industry: Otherllm

Discovered: Jun 21, 2019
Breach occurred: Apr 8, 2019 – Jun 21, 2019
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2019
Affected individuals: 1,926state + nationwide
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Took steps to secure the accounts
Launched an investigation
A cyber security firm was engaged to assist in determining what, if any, personal information may have been viewed in the accounts
Conducted a comprehensive search of the messages stored in the accounts that were accessed
Established a dedicated call center
Offering one year of complimentary credit monitoring and identity theft protection services through Kroll
Changes made: Implemented additional security enhancements to protect systems that store personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(101 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGSep 26 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ashton-woods-homes-20190930.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2019
Raw hash: d9b0a48cfae9e0ea5ad4e16127a97ea639be1a7d106b30d7935a52b816f8c9cf

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAshton Woods Homes

Victim entityAshton Woods Homes

Incidentdiscovered Jun 21, 2019

Stated responseTook steps to secure the accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov