MalwareEducationEducationRansomwareMedusaData ExfiltratedRansom DemandedCustomer Data InvolvedDownstream VictimsPIIIdentity (basic)LowContained

International Center of Photography

bd_0e29c34fc9df6ae0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 16, 2023

Filed

Feb 15, 2024

To disclose

52 weeks

Affected

2state residents only

Linked

6 filings

Confidence

68%

Full breach record for International Center of Photography →2 incidents on file

International Center of Photography (ICP) reported a ransomware incident involving the Medusa threat actor, discovered on February 16, 2023. The attack resulted in data exfiltration and encryption. ICP engaged forensic experts, rebuilt its network infrastructure, and implemented enhanced security controls including MFA and network segmentation. Two data subjects in New Hampshire were impacted. ICP did not pay the ransom.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d52 weeks discovery → filing

Incident timeline

discovery → filing · 52 weeks / 364 days

Feb 16, 2023

Discovered

Dec 15, 2023

Scope determined

Feb 15, 2024

Filed

vs. sector median

+43 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by medusa about this victim predates this filing by 361 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_c32352414d8bfcf42023-02-19 · +361dVerified by operator

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_8a9e8ea0e8a06b6f2024-02-08 · +7dVerified
Delaware State AGbd_75abf37bcfdf2f052024-02-07 · +8dVerified
Maine State AGbd_e2ef7dae4dfb60eb2024-02-07 · +8dCandidate
Indiana State AGbd_cbee27979400d8092024-02-28 · +13dVerified

Name: International Center of Photography
norm: international center of photography
Domain: icp.org

Name: International Center of Photography
norm: international center of photography
Domain: icp.org
Industry: Educationllm

Discovered: Feb 16, 2023
Materiality determined: Dec 15, 2023
Notification sent: —
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: MedusaExternalFinancial

During the incident: Engaged forensic experts and legal professionals to conduct a thorough investigation
Engaged forensic experts to upgrade and make changes to its network infrastructure
Rebuilt Active Directory structure on new servers
Wiped all workstations before connecting to new Active Directory
Installed Cylance EDR and Infocyte on all workstations and servers
Enrolled all systems in a patch management system
Implemented offsite backup system for core servers
Rotated Kerberos passwords for new Domain Controllers
Reconfigured network with multiple VLANs and ACLs
Placed public facing systems in a DMZ
Discontinued use of VPN
Disconnected Microsoft 365 environment from legacy Active Directory
Enforced MFA policies using Conditional Access rules in Azure Active Directory
Implemented Geo-IP blocks to limit logins
Forced password resets and enabled Azure AD Password Protection
Configured SaaS Alerts connected to Microsoft 365
Limited access to PowerShell to Administrative users
Changes made: Implementing additional security measures including a vulnerability management system
Conducting regular external vulnerability scans
Upgrading firewalls with East/West DPI scanning
Upgrading servers with additional backup components
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 52 weeks(364 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Delaware State AGFeb 7 · first

Maine State AGFeb 7 · first

Montana State AG+1d

New Hampshire State AG+8d · this page

Indiana State AG+21d

Pattern: first filing Feb 7 (DE), last Feb 28 (IN) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/international-center-photography-20240215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 15, 2024
Raw hash: 0cbad79b906b18bad9f12b8006c061d33f0d2bb1642a851c19de64bcd8bb10ba

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityInternational Center of Photography

Victim entityInternational Center of Photography

Incidentdiscovered Feb 16, 2023

Stated responseEngaged forensic experts and legal professionals to conduct a thorough investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov