AccidentalEducationEducationMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

Berlin Public Schools

bd_095cb55dbef8c6fe · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 23, 2022

Filed

Jun 24, 2022

To disclose

5 weeks

Affected

43state residents only

Confidence

66%

Full breach record for Berlin Public Schools →

Berlin Public Schools notified the NH Attorney General on June 24, 2022, of an incident on May 23, 2022, where an email containing a spreadsheet with employees' names and SSNs was inadvertently sent to staff. 43 NH residents were affected. The school offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 32 days

May 23, 2022

Begins

May 23, 2022

Discovered

Jun 24, 2022

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed43 affectedView incident

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Berlin Public Schools
norm: berlin public schools
Industry: Educationllm

Discovered: May 23, 2022
Breach occurred: May 23, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2022
Affected individuals: 43state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1534 Internal Remote Services
Threat actor: Internal

During the incident: Contacted the inadvertent recipients and provided instructions on properly deleting the email and attachment
Commenced a prompt and thorough investigation
Working very closely with external data privacy professionals
Offering the affected residents complimentary one-year membership with a credit monitoring service
Advising the affected residents about the process for placing a fraud alert and/or security freeze on their credit files
Changes made: Evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/berlin-public-schools-20220624.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 24, 2022
Raw hash: 5950a7f48a797e2c8a26752a5828e2d2fee140349ebdeab8551f107904b63d43

Reporting entityMCDONALD HOPKINS LLC

Victim entityBerlin Public Schools

Incidentdiscovered May 23, 2022

Stated responseContacted the inadvertent recipients and provided instructions on properly deleting the email and attachment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov