AccidentalProfessional ServicesProfessional ServicesMisdeliveryTargetedGovernment IDIdentity (basic)MediumResolved

Florida Engineers Management Corporation

bd_ecf5e171dc1e8d40 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2020

Filed

Jun 8, 2020

To disclose

10 weeks

Affected

5state residents only

Linked

3 filings

Confidence

66%

Full breach record for Florida Engineers Management Corporation →

Florida Engineers Management Corporation (FEMC) inadvertently disclosed a document containing Social Security numbers and names of 5 New Hampshire residents on Feb 11, 2020, in response to a public records request. FEMC was alerted on Apr 1, 2020, and the recipient deleted the data. FEMC notified the NH AG on Jun 8, 2020, and began notifying residents on May 27, 2020, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 50 days

discovery → filing · 10 weeks / 68 days

Feb 11, 2020

Begins

Apr 1, 2020

Discovered

Jun 8, 2020

Filed

vs. sector median

9 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_14f62e3c5d43b4352020-06-01 · +7dVerified
Montana State AGbd_437baac75f74f0372020-05-27 · +12dCandidate

Name: Florida Engineers Management Corporation
norm: florida engineers management

Name: Florida Engineers Management Corporation
norm: florida engineers management
Industry: Professional Servicesllm

Discovered: Apr 1, 2020
Breach occurred: Feb 11, 2020
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 27, 2020
Affected individuals: 5state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1567 Deception: Spearphishing LinkT1005 Data from Local System
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Requested that the recipient delete the information in all forms and verify that it had not been shared with anyone
Provided the affected residents with written notification
Provided the residents with 12 months of credit monitoring
Advised the residents about the process for placing a fraud alert and/or security freeze on their credit files
Provided contact information for consumer reporting agencies and the Federal Trade Commission
Set up a toll-free response line to respond to questions
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGMay 27 · first

Massachusetts State AG+5d

New Hampshire State AG+12d · this page

Pattern: first filing May 27 (MT), last Jun 8 (NH) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/florida-engineers-management-20200608.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2020
Raw hash: f08265dab776ce638b14fc3db8a968326958168fcf8ab5c402362be58dd40f87

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFlorida Engineers Management Corporation

Victim entityFlorida Engineers Management Corporation

Incidentdiscovered Apr 1, 2020

Stated responseRequested that the recipient delete the information in all forms and verify that it had not been shared with anyone

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov