HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

KHJ Brand Activation

bd_f6cfc99ed993e621 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 2, 2021

Filed

Mar 30, 2021

To disclose

28 days

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for KHJ Brand Activation →

KHJ Brand Activation notified individuals of a hacking incident discovered on March 2, 2021. Unauthorized parties accessed two email accounts starting December 16, 2020, potentially exposing names, addresses, SSNs, and DOBs. KHJ cut access, implemented 2FA, and offered IDX identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 28 days

Dec 16, 2020

Begins

Mar 2, 2021

Discovered

Mar 30, 2021

Filed

vs. sector median

15 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_432f5ebc31fb6bad2021-03-30Candidate
New Hampshire State AGbd_dc2c24ce9b46877c2021-03-30Verified
Massachusetts State AGbd_fcc2d54e2b4a8db02021-03-30Verified

Name: KHJ Brand Activation
norm: khj brand activation

Name: KHJ Brand Activation
norm: khj brand activation
Industry: Professional Servicesllm

Discovered: Mar 2, 2021
Breach occurred: Dec 16, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 30, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Cut off access to the hacker(s)
Added two-factor authentication to all employee email accounts
Offering identity theft protection services through IDX
Changes made: Added two-factor authentication to all employee email accounts
Taken several additional security steps to prevent similar events from transpiring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGMar 30 · first

New Hampshire State AGMar 30 · first

Massachusetts State AGMar 30 · first

Montana State AGMar 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/KHJ-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 30, 2021
Raw hash: 21dcaab25f6fa0da76fd41a0226f44f9beca724367bf45d32310546b3d49f00e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityKHJ Brand Activation

Victim entityKHJ Brand Activation

Incidentdiscovered Mar 2, 2021

Stated responseCut off access to the hacker(s)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov