MalwareHealthcareRetail & ConsumerHealthcareRansomwareData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountCriticalContained

Bosley, Inc.

bd_f01c2d03eb387789 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Aug 17, 2020

Filed

Jan 27, 2021

To disclose

23 weeks

Affected · nationwide

100,000201 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Bosley, Inc. →2 incidents on file

Bosley, Inc., a hair restoration provider, experienced a ransomware incident on August 17, 2020. The malware encrypted data on certain systems. Forensic investigation later determined that an unauthorized party accessed systems containing personal information of over 100,000 individuals, including names, SSNs, financial account numbers, and driver's license numbers. 201 New Hampshire residents were affected. Bosley contained the incident, restored systems from backups, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 23 weeks / 163 days

Aug 17, 2020

Discovered

Jan 27, 2021

Filed

vs. sector median

+11 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_da2e6501a2cfa56b2021-01-26 · +1dVerified
Maine State AGbd_ee7b1b68b5b8c3982021-01-26 · +1dCandidate
Illinois State AGbd_41aaacb63d0e52bc2021-01-01 · +26dVerified

Name: Bosley, Inc.
norm: bosley
Domain: www.bosley.com

Name: Bosley, Inc.
norm: bosley
Domain: bosley.com
Industry: HealthcarellmRetail & Consumerllm

Discovered: Aug 17, 2020
Materiality determined: —
Notification sent: Jan 26, 2021
Affected individuals: 100,000state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Notified Attorney General Gordon McDonald, Office of the Attorney General, New Hampshire

During the incident: Retained Baker & Hostetler, LLP to provide legal advice and assistance investigating and responding to the incident
Engaged cybersecurity consultants to conduct a forensic investigation
Identified and contained the incident
Restored systems from available backups
Updated passwords
Implemented additional security safeguards and controls in its network infrastructure
Offering individuals a one-year membership to credit monitoring and identity protection services
Established a dedicated, toll-free call center where individuals may obtain more information regarding the incident
Began mailing notification letters to the 201 New Hampshire residents
Changes made: Updated passwords
Implemented additional security safeguards and controls in its network infrastructure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(163 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+25d

Maine State AG+25d

New Hampshire State AG+26d · this page

Pattern: first filing Jan 1 (IL), last Jan 27 (NH) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bosley-20210127.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 27, 2021
Raw hash: b78b8af2dc2e104b1970d056a2228b4dcbb3ab5035ecb885202641a1f68da854

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBosley, Inc.

Victim entityBosley, Inc.

Incidentdiscovered Aug 17, 2020

Stated responseRetained Baker & Hostetler, LLP to provide legal advice and assistance investigating and responding to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov