HackingTechnologyInformationStolen CredentialsNation State SuspectedTargetedMulti-Stage ChainIdentity (basic)CredentialsLowContained

HEWLETT PACKARD ENTERPRISE COMPANY

bd_ea1b03ceb303c159 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 12, 2023

Filed

Feb 5, 2025

To disclose

14 months

Affected

33state residents only

Linked

6 filings

Confidence

67%

Full breach record for HEWLETT PACKARD ENTERPRISE COMPANY →2 incidents on file

Hewlett Packard Enterprise Company notified the Maryland Attorney General on February 4, 2025, of a data event affecting 33 Maryland residents. On December 12, 2023, a suspected nation-state actor gained unauthorized access to HPE's cloud-based email environment. HPE engaged external experts to contain and remediate the incident. Affected individuals received notice starting January 29, 2025, and were offered 24 months of credit monitoring and identity theft restoration services.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d14 months discovery → filing

Incident timeline

discovery → filing · 14 months / 421 days

Dec 12, 2023

Discovered

Feb 5, 2025

Filed

vs. sector median

+41 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by meow about this victim predates this filing by 204 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitecl0pbd_ea8f93e79e171d342025-02-27 · +23dCandidate
Leak Sitemeowbd_1bed9a57dd205c272024-07-16 · +204dVerified by operator

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_edabcc46d1f65c2b2025-02-05Verified
Massachusetts State AGbd_f9e49613c2a65fc02025-02-05Verified
Nebraska State AGbd_d6b81ec9772a47e52025-01-29 · +7dCandidate

Name: HEWLETT PACKARD ENTERPRISE COMPANY
norm: hewlett packard enterprise
Domain: hpe.com

Name: HEWLETT PACKARD ENTERPRISE COMPANY
norm: hewlett packard enterprise
Domain: hpe.com
Industry: Technologyllm

Discovered: Dec 12, 2023
Materiality determined: —
Notification sent: Jan 29, 2025
Affected individuals: 33state-resident count only
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing Application
Threat actor: ExternalEspionage
Regulator citations: Notified Maryland Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Engaged external cybersecurity experts to investigate, contain, and remediate the incident
Notified law enforcement
Offered impacted individuals access to 24 months of complimentary credit monitoring and identity theft restoration services
Changes made: Strengthening network security by rotating passwords, tokens and keys
Expanding monitoring and logging measures
Implementing additional controls and requirements for privileged account logins
Expanding internal communication around security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 months(421 days from discovery to filing)
Compliance flags: MD AG >90dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGJan 29 · first

New Hampshire State AG+7d

Massachusetts State AG+7d

Maryland State AG+7d · this page

Pattern: first filing Jan 29 (NE), last Feb 5 (MD) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376326.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 5, 2025
Raw hash: f9c1d18f5aaf8a44117e5b0b22b482a60888174d51d3c62d8ec369f8116ac051

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entityHEWLETT PACKARD ENTERPRISE COMPANY

Victim entityHEWLETT PACKARD ENTERPRISE COMPANY

Incidentdiscovered Dec 12, 2023

Stated responseEngaged external cybersecurity experts to investigate, contain, and remediate the incident

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov