HackingCustomer Data InvolvedIdentity (basic)LowContained

Ora, LLC

bd_e3392b73212b4a76 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 10, 2024

Filed

Oct 17, 2024

To disclose

23 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Ora, LLC →

Ora, LLC notified the New Hampshire Attorney General on October 17, 2024, of a data security incident discovered on May 10, 2024. Unknown actors claimed to have downloaded data from Ora's network. Ora investigated with independent experts and confirmed on August 26, 2024, that personal information (names) of approximately 3 New Hampshire residents was included in the purportedly downloaded files. No evidence confirmed the data was actually taken. Ora offered complimentary identity monitoring via Kroll and implemented additional security features.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 23 weeks / 160 days

May 10, 2024

Discovered

Aug 26, 2024

Scope determined

Oct 17, 2024

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_29bd1a722135b9a32024-10-17Candidate
Massachusetts State AGbd_91be6cd43461b9c22024-10-18 · +1dVerified

Name: Ora, LLC
norm: ora

Name: Ora, LLC
norm: ora

Discovered: May 10, 2024
Materiality determined: Aug 26, 2024
Notification sent: Oct 17, 2024
Affected individuals: 3state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General

During the incident: Commenced an investigation aided by independent cybersecurity experts
Undertook a comprehensive review of the impacted files
Implemented additional security features to reduce the risk of a similar incident occurring in the future
Secured the services of Kroll to provide identity monitoring at no cost
Changes made: Implemented additional security features to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(160 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGOct 17 · first

New Hampshire State AGOct 17 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ora-20241017.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 17, 2024
Raw hash: 552d7f14f94f1c3863a1f516ca00aba352fde394af4db3502dabdafa004a10fa

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityOra, LLC

Victim entityOra, LLC

Incidentdiscovered May 10, 2024

Stated responseCommenced an investigation aided by independent cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov