Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDHealth (basic)CredentialsMediumContained

New Heights Ventures

bd_e6420aa8a2894ae5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 11, 2020

Filed

Mar 12, 2020

To disclose

≤1 day

Affected

Not disclosed

Confidence

65%

Full breach record for New Heights Ventures →

New Heights Ventures Inc. experienced a phishing incident where an external entity compromised a management email account via a malicious link on March 6, 2020. The attacker forwarded emails to contacts, leading two employees to enter their credentials. This allowed access to employee files containing names, birthdates, SSNs, Livescan results, and medical leave info. Access was cut, and 2FA was implemented.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · ≤1 day / 1 days

Mar 6, 2020

Begins

Mar 11, 2020

Discovered

Mar 12, 2020

Filed

vs. sector median

19 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: New Heights Ventures
norm: new heights
Domain: newheightsventures.org

Name: New Heights Ventures
norm: new heights
Domain: newheightsventures.org
Industry: Professional Servicesllm

Discovered: Mar 11, 2020
Breach occurred: Mar 6, 2020 – Mar 11, 2020
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Credentials
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Contacting the various governmental agencies
Initial access: phishing_link

During the incident: Took steps to cut access from the outside entity
Initiated a 2-factor authorization for cloud-based server and email access
Contacting the various governmental agencies
Changes made: Initiated a 2-factor authorization for cloud-based server and email access
Looking at removing cloud-based storage for employee files and using an onsite encrypted server for this information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-188238
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2020
Raw hash: 59bc042964741f4c6f7e7a586e47ddfb5f5bab1f66d2263cd1d48d0ebfb0d956

Reporting entityNew Heights Ventures

Victim entityNew Heights Ventures

Incidentdiscovered Mar 11, 2020

Stated responseTook steps to cut access from the outside entity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov