Social EngineeringProfessional ServicesProfessional ServicesPhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Anderson & Vreeland, Inc.

bd_f6c2412bc4bd4468 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 24, 2018

Filed

Jun 28, 2018

To disclose

9 weeks

Affected

3state residents only

Confidence

66%

Full breach record for Anderson & Vreeland, Inc. →

Anderson & Vreeland, Inc. notified the New Hampshire Attorney General of a phishing incident affecting three NH residents. Unauthorized access to employee email accounts occurred from Jan 9, 2018 to Feb 28, 2018. Personal information (names, SSNs, driver's license numbers) was accessed. Notifications were mailed on June 28, 2018, offering one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 105 days

discovery → filing · 9 weeks / 65 days

Jan 9, 2018

Begins

Apr 24, 2018

Discovered

Jun 28, 2018

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Anderson & Vreeland, Inc.
norm: anderson vreeland
Industry: Professional Servicesllm

Discovered: Apr 24, 2018
Breach occurred: Jan 9, 2018 – Feb 28, 2018
Undetected for: 105 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 28, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Engaged a leading cyber security firm to assist in those efforts
Began mailing written notifications to potentially affected individuals
Offered eligible potentially affected individuals a complimentary one-year membership to Experian's IdentityWorks credit monitoring and identity theft protection services
Changes made: Providing additional training to employees regarding phishing emails
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(65 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/anderson-20180628.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 28, 2018
Raw hash: 841983f7c0e3bbd1d2efdccdc35f6cb016cc32a7408a760eac302dd8f6e3e76f

Reporting entityBAKER & HOSTETLER LLP

Victim entityAnderson & Vreeland, Inc.

Incidentdiscovered Apr 24, 2018

Stated responseEngaged a leading cyber security firm to assist in those efforts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov