Social EngineeringProfessional ServicesProfessional ServicesPhishingCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

LightHouse Management Services, LLC

bd_f8650f58187a2abd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 19, 2017

Filed

Oct 20, 2017

To disclose

13 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for LightHouse Management Services, LLC →

LightHouse Management Services, LLC (d/b/a Home Properties) notified the NH Attorney General of a data security incident. On July 19, 2017, the company learned of suspicious activity related to an employee's email account, which was accessed without authorization between July 19 and July 26, 2017. The incident involved a phishing email. Affected data included names, addresses, SSNs, driver's license numbers, bank account numbers, and credit card numbers. Approximately 2 NH residents and 1 NH business were affected. The company engaged forensic investigators, changed passwords, and offered 36 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 93 days

Jul 19, 2017

Begins

Jul 19, 2017

Discovered

Oct 20, 2017

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_c5463d1ea8a9db1a2017-10-20Candidate
Massachusetts State AGbd_d4a8307c124d0f9c2017-10-20Verified

Name: LightHouse Management Services, LLC
norm: lighthouse management services

Name: LightHouse Management Services, LLC
norm: lighthouse management
Industry: Professional Servicesllm

Discovered: Jul 19, 2017
Breach occurred: Jul 19, 2017 – Jul 26, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 20, 2017
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Initiated an internal investigation
Hired a third-party forensic investigator
Ensured that the affected employee's password was changed
Ensured that all employees who received the phishing email changed their passwords
Continues to monitor their systems to ensure the privacy and security of personal information
Changes made: Providing all potentially affected individuals access to 36 months of complimentary credit monitoring and identity restoration services, through AllClear ID
Providing potentially impacted individuals and businesses with guidance on how to better protect against identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(93 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGOct 20 · first

Massachusetts State AGOct 20 · first

New Hampshire State AGOct 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lighthouse-management-20171020.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2017
Raw hash: b407364c5f1e5ddb984ef3da1d79a2025dc899074d26e2f1383deaf4b0e46b33

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityLightHouse Management Services, LLC

Victim entityLightHouse Management Services, LLC

Incidentdiscovered Jul 19, 2017

Stated responseInitiated an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov