HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Financial accountLowContained

Abel Womack, Inc.

bd_f2ff973c485400b4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 1, 2016

Filed

Mar 9, 2016

To disclose

8 days

Affected · nationwide

8715 in this filing

Linked

2 filings

Confidence

68%

Full breach record for Abel Womack, Inc. →

Abel Womack, Inc. notified the NH AG of a breach where an unauthorized party used the HR manager's login to access and change direct deposit information for 87 employees across 7 states. The incident was discovered on March 1, 2016. Affected data included names, bank routing numbers, and account numbers. The hack was interrupted, passwords changed, and 2FA implemented.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 days

Mar 1, 2016

Discovered

Mar 9, 2016

Filed

vs. sector median

17 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_8b493a79aa6168c72016-03-08 · +1dVerified

Name: Abel Womack, Inc.
norm: abel womack

Name: Abel Womack, Inc.
norm: abel womack
Industry: Professional Servicesllm

Discovered: Mar 1, 2016
Materiality determined: —
Notification sent: —
Affected individuals: 87state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's OfficeInformed the Lawrence, Massachusetts Police Department
Initial access: valid_credentials

During the incident: Interrupted the hack
Sent all employees a notice of the breach via corporate email
Had employees contact their banks for advice and assistance
Required employees to change their direct deposit information in the HRIS system
Removed direct deposit from accounts of employees who had not updated their information
Changed the HR Manager's password for the HRIS site
Implementing a 2 step verification for administrators on the site
Informed the Lawrence, Massachusetts Police Department
Contacted Green Dot bank
Changes made: Implementing a 2 step verification for administrators on the site
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 8 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/abel-womack-20160309.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 9, 2016
Raw hash: 0eeb05b71926da3f124274562ad6a18a97df869bc92fdb03745a27bf316a5e98

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAbel Womack, Inc.

Victim entityAbel Womack, Inc.

Incidentdiscovered Mar 1, 2016

Stated responseInterrupted the hack

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov