HackingHealthcareProfessional ServicesHealthcareStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

BLA Partners, LLC

bd_f4b67e8208b1dd9d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 21, 2019

Filed

Oct 7, 2019

To disclose

7 weeks

Affected

9state residents only

Linked

2 filings

Confidence

67%

Full breach record for BLA Partners, LLC →

BLA Partners, LLC dba Aspenti Health notified the NH Attorney General of an employee email account compromise. The incident, discovered on August 21, 2019, potentially exposed names and SSNs of 9 NH residents. Aspenti shut down affected accounts, engaged forensic investigators, and is providing identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 47 days

Aug 21, 2019

Discovered

Oct 7, 2019

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_98d28b18ee9582d12019-10-07Verified

Name: BLA Partners, LLC
norm: bla partners

Name: BLA Partners, LLC
norm: bla partners
Also named: BLA Partners, LLCdba oflegal entity
Aspenti Healthdba oftrade name
Industry: HealthcarellmProfessional Servicesllm

Discovered: Aug 21, 2019
Materiality determined: —
Notification sent: Oct 7, 2019
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Immediately shut down the affected email boxes
Hired a leading forensic security firm to investigate and confirm the overall security of its email and computer systems
Promptly terminated the account credentials
Changes made: Providing complimentary identity theft protection services to the impacted individuals through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 7 · first

New Hampshire State AGOct 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bla-partners20191007.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 7, 2019
Raw hash: 9a222824d331cabfc7cc16a6608d127425e71584567924abf0f725bd3ecdf158

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBLA Partners, LLC

Victim entityBLA Partners, LLC

Incidentdiscovered Aug 21, 2019

Stated responseImmediately shut down the affected email boxes

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov