HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Borden Perlman Salisbury & Kelly Insurance

bd_fbcc9c04dd978d25 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 7, 2016

Filed

Oct 10, 2016

To disclose

14 weeks

Affected

7state residents only

Linked

3 filings

Confidence

66%

Full breach record for Borden Perlman Salisbury & Kelly Insurance →

Borden Perlman Insurance notified NH AG of unauthorized access to two employee email accounts discovered July 7, 2016. Incident affected 7 NH residents, exposing names and SSNs. Response included forensic investigation, credit monitoring via Kroll, and notifications to affected individuals and regulators.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 95 days

Jul 7, 2016

Discovered

Oct 10, 2016

Filed

vs. sector median

+4 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_71b5a264393084992016-10-14 · +4dVerified
Montana State AGbd_4559d2d807252d372016-10-05 · +5dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Borden Perlman Salisbury & Kelly Insurance
norm: borden perlman salisbury kelly insurance
Industry: Financial Servicesllm

Discovered: Jul 7, 2016
Materiality determined: —
Notification sent: Oct 5, 2016
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: providing written notice of this incident to other state regulators where required
Initial access: valid_credentials

During the incident: Launched an internal investigation
Retained third-party forensic experts to assist in the investigation
Undertook a thorough analysis and review of all documents within the email accounts
Hired a vendor to provide address look up services
Notified the colleges and universities who had purchased Sport Accident insurance policies
Began mailing notice letters to impacted individuals
Offering potentially affected complimentary access to twelve (12) months of free credit monitoring and identity restoration services with Kroll
Providing potentially affected individuals with information on how to protect against identity theft and fraud
Providing written notice of this incident to other state regulators where required
Changes made: Taken precautionary measures to better prevent something like this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(95 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGOct 5 · first

New Hampshire State AG+5d · this page

Massachusetts State AG+9d

Pattern: first filing Oct 5 (MT), last Oct 14 (MA) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/borden-perlman-20161010.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2016
Raw hash: f395e9c6895ed979437b48a18b720d3aad8babe3e0b2f04f694ba83361073213

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityBorden Perlman Salisbury & Kelly Insurance

Incidentdiscovered Jul 7, 2016

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov