MalwareTelecom & MediaInformationRansomwareRansom DemandedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

AireSpring, Inc.

bd_e7541606e0e31d79 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 7, 2021

Filed

Jun 14, 2021

To disclose

10 weeks

Affected

17state residents only

Linked

5 filings

Confidence

66%

Full breach record for AireSpring, Inc. →

AireSpring, Inc., a California telecommunications company, experienced a ransomware attack. The company discovered the incident on April 7, 2021, though the attack began on April 7, 2020. Personal information of 17 New Hampshire residents was impacted, including names, Social Security numbers, payment card information, and health insurance data. The company contained the incident, engaged forensic experts, and notified law enforcement. Affected individuals were offered credit monitoring and identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 365 days

discovery → filing · 10 weeks / 68 days

Apr 7, 2020

Begins

Apr 7, 2021

Discovered

Jun 14, 2021

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_017ea993261584a32021-06-11 · +3dVerified
Montana State AGbd_1ff94ac48512112f2021-06-10 · +4dCandidate
California State AGbd_2782ac2cd9a65b792021-06-10 · +4dVerified
Maine State AGbd_3df0cbbadafe99fb2021-06-10 · +4dVerified

Name: AireSpring, Inc.
norm: airespring

Name: AireSpring, Inc.
norm: airespring
Industry: Telecom & Mediallm

Discovered: Apr 7, 2021
Breach occurred: Apr 7, 2020
Undetected for: 365 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 10, 2021
Affected individuals: 17state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General of New Hampshire

During the incident: Took the affected systems offline
Retained a forensic expert to assist in its investigation
Promptly informed federal law enforcement
Working with an independent forensic firm to implement additional technical and organizational safeguards
Changes made: Hardened its systems to prevent the possibility of a future ransomware attack
Working with independent third party security consultants to strengthen and enhance information security controls and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJun 10 · first

California State AGJun 10 · first

Maine State AGJun 10 · first

Massachusetts State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/airespring-20210614.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2021
Raw hash: ca48708f9e6e991f24750e11a3e25fabc117ed24eba3b34065304ef7023ea413

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAireSpring, Inc.

Victim entityAireSpring, Inc.

Incidentdiscovered Apr 7, 2021

Stated responseTook the affected systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov