Social EngineeringProfessional ServicesProfessional ServicesPhishingBECWire FraudCustomer Data InvolvedIdentity (basic)Financial accountGovernment IDMediumContained

Concept Title Services, Inc.

bd_ed2cb92683896d4f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 7, 2018

Filed

Aug 14, 2018

To disclose

7 days

Affected

2state residents only

Confidence

66%

Full breach record for Concept Title Services, Inc. →

Concept Title Services, Inc. notified the NH Attorney General of a phishing attack on a client's email account, discovered on August 7, 2018, which resulted in wire fraud. The incident potentially compromised contact, financial, and government ID information for approximately 2 New Hampshire residents. The company contained the incident, engaged forensic investigators, and implemented additional security measures including staff training and access control restrictions.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 days

Aug 7, 2018

Discovered

Aug 14, 2018

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Concept Title Services, Inc.
norm: concept title

Name: Concept Title Services, Inc.
norm: concept title
Industry: Professional Servicesllm

Discovered: Aug 7, 2018
Materiality determined: —
Notification sent: Aug 15, 2018
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial accountGovernment ID
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Joseph Foster of New Hampshire
Initial access: phishing_link

During the incident: Retained an independent forensic analysis firm and legal counsel to assist us with incident response, analysis, containment, recovery and notification
Completed forensic analysis on this Incident
Contained the incident
Changes made: Taking additional security measures to prevent future incidents of this nature, including data protection training for staff to identify phishing attacks and other security issues
Further restriction of access controls
Implementing a secure mechanism to transfer sensitive personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/concept-title-20180814.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2018
Raw hash: 555d041ce4a0efdb144a1f940dc0b6d2b412c7548cd333811d29987144558312

Reporting entityConcept Title Services, Inc.

Victim entityConcept Title Services, Inc.

Incidentdiscovered Aug 7, 2018

Stated responseRetained an independent forensic analysis firm and legal counsel to assist us with incident response, analysis, containment, recovery and notification

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov