HackingOtherDelayed DiscoveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

The Southwestern Family of Companies

bd_e2bcbc3d7340aa63 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 17, 2021

Filed

Aug 4, 2022

To disclose

37 weeks

Affected

12state residents only

Linked

5 filings

Confidence

64%

Full breach record for The Southwestern Family of Companies →

The Southwestern Family of Companies notified the NH AG of a data event affecting 12 NH residents. Suspicious activity was discovered on Nov 17, 2021. Potentially accessed data included names, addresses, and SSNs. The company engaged forensic specialists, reset passwords, and offered 12 months of Equifax credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 37 weeks / 260 days

Nov 17, 2021

Discovered

Aug 4, 2022

Filed

vs. sector median

+29 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_5b95ba7eff72a2032022-08-01 · +3dCandidate
Maine State AGbd_a11a949a9ea3d32d2022-08-01 · +3dVerified
Massachusetts State AGbd_c0b8ebca289e37fd2022-08-01 · +3dVerified
Indiana State AGbd_f367c8b94cde79d72022-08-01 · +3dVerified

Name: The Southwestern Family of Companies
norm: the southwestern family of companies

Name: The Southwestern Family of Companies
norm: the southwestern family of companies
Industry: Otherllm

Discovered: Nov 17, 2021
Materiality determined: —
Notification sent: Aug 1, 2022
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau

During the incident: Launched an investigation to determine the nature and scope of the activity
Working with industry-leading computer forensics specialists
Completed a thorough review of these files and folders
Worked to validate the data mining results
Confirm the identities of potentially affected individuals
Locate address information for individuals
Resetting relevant account passwords
Reviewing the contents of the impacted systems
Reviewing internal systems to identify contact information
Providing access to credit monitoring services for twelve (12) months through Equifax
Changes made: Implement additional safeguards and training to its employees
Reviewing existing policies and procedures to reduce the likelihood of a similar future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(260 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGAug 1 · first

Maine State AGAug 1 · first

Massachusetts State AGAug 1 · first

Indiana State AGAug 1 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/southwestern-family-companies-20220804.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2022
Raw hash: da3f0bb29dc837d866c26a5b787a9cfe706ae76b0bb02a1f0c9e3fb79e8ec3c0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Southwestern Family of Companies

Victim entityThe Southwestern Family of Companies

Incidentdiscovered Nov 17, 2021

Stated responseLaunched an investigation to determine the nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov