HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTHighContained
WebTPA Employer Services, LLC
bd_eac90263c980f3a3 · schema v1 · pii pii-v1
Full breach record for WebTPA Employer Services, LLC →WebTPA Employer Services, LLC reported a data security incident to the New Hampshire Attorney General on May 8, 2024. Unauthorized access occurred via a VPN connection starting March 6, 2023, with exfiltration between April 18-23, 2023. The breach affected at least 3,510 New Hampshire residents, exposing eligibility files containing personal information. WebTPA notified law enforcement, engaged third-party experts, and offered complimentary identity monitoring services to affected individuals.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_0297133fa0336cc0Montana State AGfiled 2024-05-08Verified
- bd_49634d385eadc99bHHS OCRfiled 2024-05-08Verified
- bd_63c3547b07349003Indiana State AGfiled 2024-05-08Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/webtpa-employer-services-20240508.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 8, 2024
- Raw hash
- aaf331861a34c03f4da2a8e4123621f59e63e7076623014669d62fd64fbf2d52
Reporting entity
- Name
- HOGAN LOVELLS US LLPnorm: hogan lovells us
Victim entity
- Name
- WebTPA Employer Services, LLCnorm: webtpa employer
Incident
- Discovered
- Dec 28, 2023
- Materiality determined
- —
- Notification sent
- May 8, 2024
- Affected individuals
- 3,510
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1133 External Remote ServicesT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Office of the Attorney General
- Initial access
- external_remote_services
Compliance
- Time to disclose
- 19 weeks(132 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.