HackingTransportation & LogisticsTransportationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

CommuteAir •

bd_edea170223ff015b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 9, 2022

Filed

Nov 18, 2022

To disclose

9 days

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for CommuteAir • →2 incidents on file

CommuteAir, LLC. reported that on November 9, 2022, an unauthorized individual gained access to a third-party HRIS via an API. The incident involved employee names, dates of birth, and the last four digits of SSNs. CommuteAir engaged cybersecurity consultants, notified law enforcement, and offered one year of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 days

Nov 9, 2022

Discovered

Nov 18, 2022

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_2ea12ee209ee29f42022-11-17 · +1dVerified
Maine State AGbd_92d58de45884371b2022-11-17 · +1dCandidate
Montana State AGbd_c09ec8830c2a9fe42022-11-17 · +1dVerified
Massachusetts State AGbd_db9a960c2d300a1e2022-11-17 · +1dVerified

Name: CommuteAir •
norm: commuteair
Domain: commuteair.com

Name: CommuteAir •
norm: commuteair
Domain: commuteair.com
Industry: Transportation & Logisticsllm

Discovered: Nov 9, 2022
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the appropriate authoritiesWorking closely with law enforcement
Initial access: exploit_public_facing

During the incident: Engaged outside cybersecurity consultants
Implemented additional security measures
Notified the appropriate authorities
Working closely with law enforcement
Offering one year of free identity theft protection through the LifeLock Defender Choice plan
Changes made: Implemented additional security measures designed to prevent a recurrence of such an attack
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGNov 17 · first

Maine State AGNov 17 · first

Montana State AGNov 17 · first

Massachusetts State AGNov 17 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/commuteair-20221118.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 18, 2022
Raw hash: 5e8cc79dd4a9ee6fac08a2105eba5d461f8cc6358fd320958c92f13881272dbf

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCommuteAir •

Victim entityCommuteAir •

Incidentdiscovered Nov 9, 2022

Stated responseEngaged outside cybersecurity consultants

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov