HackingOtherVulnerability ExploitStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

Goldenvoice

bd_f5c6a0239c596622 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 21, 2017

Filed

Mar 23, 2017

To disclose

4 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Goldenvoice →

Goldenvoice notified the NH Attorney General of a breach affecting 2 NH residents. Hackers accessed data from Sept 2016 to Feb 2017. Affected data included names, emails, DOBs, and government IDs (driver's licenses/passports) for wristband pick-ups. No financial data or passwords were compromised. Incident contained; forensic firm engaged; identity protection offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 173 days

discovery → filing · 4 weeks / 30 days

Sep 1, 2016

Begins

Feb 21, 2017

Discovered

Mar 23, 2017

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_a2cc8bceff368a262017-03-24 · +1dVerified
Massachusetts State AGbd_dc5049836cea893b2017-03-27 · +4dVerified

Name: Goldenvoice
norm: goldenvoice

Name: Goldenvoice
norm: goldenvoice
Industry: Otherllm

Discovered: Feb 21, 2017
Breach occurred: Sep 1, 2016 – Feb 28, 2017
Undetected for: 173 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 23, 2017
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: exploit_public_facing

During the incident: Opened an investigation
Notified law enforcement
Engaged a leading forensic IT firm
Contained the incident and terminated unauthorized access
Remediated the relevant security vulnerability
Applied important security updates to our systems
Arranged for identity theft protection at no cost to qualifying US individuals
Changes made: Remediated the relevant security vulnerability
Applied important security updates to our systems
Taken other proactive measures to help safeguard our services
Arranged for identity theft protection at no cost to qualifying US individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 23 · first · this page

California State AG+1d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/goldenvoice-20170323.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2017
Raw hash: 7a9b8ea95cd507f95ad9f2d1af47db4b166ac9f83e0225fa597a736105b04ed6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGoldenvoice

Victim entityGoldenvoice

Incidentdiscovered Feb 21, 2017

Stated responseOpened an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov