MalwareEducationEducationRansomwareData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumActive

The New Hampton School

bd_039fa314946e593e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Jan 19, 2021

To disclose

27 weeks

Affected

694state residents only

Linked

5 filings

Confidence

66%

Full breach record for The New Hampton School →

New Hampton School notified the NH Attorney General of a third-party breach involving Blackbaud. A cybercriminal exfiltrated data from Blackbaud's systems between Feb 7 and May 20, 2020, including names and SSNs of 694 NH residents. The incident involved an attempted ransomware attack which was stopped, but data was removed. The School provided 24 months of credit monitoring to affected residents.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 27 weeks / 187 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Jan 19, 2021

Filed

This filing is one of 5 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_100089e9e4e4ae8f2021-01-22 · +3dVerified
Maine State AGbd_aa12622b18ccb9472021-01-14 · +5dVerified by operator
Indiana State AGbd_302f77c076bc392d2021-01-11 · +8dVerified
Montana State AGbd_8a53006b6aa4b1ea2021-01-11 · +8dCandidate

Name: The New Hampton School
norm: the new hampton school

Name: The New Hampton School
norm: the new hampton school
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 11, 2021
Affected individuals: 694state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Third party: via Blackbaud
Initial access: external_remote_services

During the incident: Engaged cybersecurity professionals experienced in handling these types of incidents
Demanded detailed information from Blackbaud about the nature and scope of the incident
Provided affected residents with written notification of this incident
Provided the affected residents with 24 months of complimentary credit monitoring
Advised the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(187 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 11 · first

Montana State AGJan 11 · first

Maine State AG+3d

New Hampshire State AG+8d · this page

Massachusetts State AG+11d

Pattern: first filing Jan 11 (IN), last Jan 22 (MA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/new-hampton-school-20210119.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 19, 2021
Raw hash: cc128ba6a90cf087f61f16c1f2740a48aceb01599a46e95ab17ef8a732a79d67

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe New Hampton School

Victim entityThe New Hampton School

Incidentdiscovered Jul 16, 2020

Stated responseEngaged cybersecurity professionals experienced in handling these types of incidents

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov