HackingManufacturingManufacturingCustomer Data InvolvedPIIIdentity (basic)LowContained

EASTERN SHIPBUILDING GROUP, INC.

bd_fe3e9933ddba036c · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 4, 2024

Filed

Oct 22, 2024

To disclose

37 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for EASTERN SHIPBUILDING GROUP, INC. →

Eastern Shipbuilding Group notified New Hampshire of a security incident discovered on Feb 4, 2024, where an unknown actor accessed certain files. One NH resident was identified. ESG engaged forensic specialists, notified law enforcement, and offered credit monitoring via Experian. Data types included PII.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d37 weeks discovery → filing

Incident timeline

discovery → filing · 37 weeks / 261 days

Feb 4, 2024

Discovered

Apr 25, 2024

Scope determined

Oct 22, 2024

Filed

vs. sector median

+27 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 262 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_b213663903a8a85a2024-02-03 · +262dVerified

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_18052bc17fe5f6b52024-10-21 · +1dVerified
Maine State AGbd_237252f23b796b152024-06-28 · +116dVerified
Indiana State AGbd_4ec134c7648b67502024-06-28 · +116dVerified

Name: EASTERN SHIPBUILDING GROUP, INC.
norm: eastern shipbuilding
Domain: easternshipbuilding.com

Name: EASTERN SHIPBUILDING GROUP, INC.
norm: eastern shipbuilding
Domain: easternshipbuilding.com
Industry: Manufacturingllm

Discovered: Feb 4, 2024
Materiality determined: Apr 25, 2024
Notification sent: Jun 28, 2024
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notified federal law enforcement regarding the event

During the incident: Moved quickly to investigate and respond to the incident
Assess the security of ESG systems
Identify potentially affected individuals
Notified federal law enforcement regarding the event
Provided their employees with complementary credit monitoring
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for , through Experian, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Advising individuals to report any suspected incidents of identity theft or fraud to their credit card company and/or bank
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing individuals with contact details for the national consumer reporting agencies
Providing individuals with information on how to obtain a free credit report
Encouragement to contact the Federal Trade Commission, their state Attorney General, and law enforcement to report attempted or actual identity theft and fraud
Providing written notice of this incident to relevant state regulators, as necessary
Changes made: Implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(261 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Maine State AGJun 28 · first

Indiana State AGJun 28 · first

Maine State AG+115d

New Hampshire State AG+116d · this page

Pattern: first filing Jun 28 (ME), last Oct 22 (NH) — a 116-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/eastern-shipbuilding-group-20241022.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 22, 2024
Raw hash: ddbf54d8b293a693344df979805e0bc05d72b914feb17010f178e8c2705a1e00

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityEASTERN SHIPBUILDING GROUP, INC.

Victim entityEASTERN SHIPBUILDING GROUP, INC.

Incidentdiscovered Feb 4, 2024

Stated responseMoved quickly to investigate and respond to the incident

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov