Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Statewide Aquastore, Inc.

bd_e273826bed9d4f18 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 12, 2024

Filed

Sep 5, 2024

To disclose

24 days

Affected · nationwide

353 in this filing

Confidence

67%

Full breach record for Statewide Aquastore, Inc. →2 incidents on file

Statewide Aquastore, Inc. notified New Hampshire residents of a data breach involving third-party provider Arete Advisors, LLC. An unauthorized individual sent an email containing personal information (name, SSN) of approximately 35 individuals. Statewide discovered the incident on August 12, 2024, and filed notice with the NH AG on September 5, 2024. Credit monitoring via Experian is offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 days

Aug 12, 2024

Discovered

Sep 5, 2024

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed35 affectedView incident

Name: Statewide Aquastore, Inc.
norm: statewide aquastore
Domain: statewideaquastore.com

Name: Statewide Aquastore, Inc.
norm: statewide aquastore
Domain: statewideaquastore.com
Industry: Retail & Consumerllm

Discovered: Aug 12, 2024
Materiality determined: —
Notification sent: Sep 5, 2024
Affected individuals: 35state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email Collection
Threat actor: External
Regulator citations: providing written notice of this incident to relevant state regulators
Third party: via Arete Advisors, LLC
Initial access: phishing_link

During the incident: Moved quickly to investigate and respond to the event
Notify potentially affected individuals
Providing access to credit monitoring services for , through Experian, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators
Changes made: Reviewing and enhancing their existing policies and procedures related to data privacy to reduce the likelihood of a similar event in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/statewide-aquastore-20240905.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2024
Raw hash: 68626f7d65ae5fdf65b6ffdc9114e1fbc6a1e77a02cfd1219d36b5a6e2bb3b98

Reporting entityStatewide Aquastore, Inc.

Victim entityStatewide Aquastore, Inc.

Incidentdiscovered Aug 12, 2024

Stated responseMoved quickly to investigate and respond to the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov