MalwareGovernmentGovernmentRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Forsyth County, Georgia

bd_19cfb443052e8099 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 24, 2023

Filed

Jun 9, 2023

To disclose

19 weeks

Affected

1state residents only

Linked

4 filings

Confidence

65%

Full breach record for Forsyth County, Georgia →

Forsyth County, Georgia, notified the NH AG of a ransomware attack occurring between Dec 26, 2022, and Jan 24, 2023. Unauthorized access resulted in the removal of files containing names and SSNs from a County server. One New Hampshire resident was affected. The County engaged federal law enforcement and forensic investigators, reset passwords, and enhanced security controls. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

discovery → filing · 19 weeks / 136 days

Dec 26, 2022

Begins

Jan 24, 2023

Discovered

May 9, 2023

Scope determined

Jun 9, 2023

Filed

vs. sector median

+9 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_eac0035d70fd4fa12023-08-29 · +81dVerified by operator

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_19a6417963a5e9802023-06-06 · +3dCandidate
Massachusetts State AGbd_4623afed2dc128342023-06-13 · +4dVerified by operator

Name: Forsyth County, Georgia
norm: forsyth county georgia

Name: Forsyth County, Georgia
norm: forsyth county georgia
Industry: Governmentllm

Discovered: Jan 24, 2023
Breach occurred: Dec 26, 2022 – Jan 24, 2023
Undetected for: 29 daysoccurrence → discovery
Materiality determined: May 9, 2023
Notification sent: Jun 6, 2023
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Provided notice to the New Hampshire Attorney GeneralAssistance of Federal law enforcement

During the incident: Launched an investigation to determine the nature and scope of the unauthorized activity with the assistance of Federal law enforcement and a nationally recognized digital forensics firm
Worked quickly to secure our network and begin a thorough investigation
Searched Dark Web sources
Changes made: Undertook an enterprise-wide password reset
Updated procedures to require manual review of all vendor accounts
Enhanced remote access security requirements
Expanding onsite data protection efforts including increased data encryption and extended onsite monitoring for cyber events
Strengthening County infrastructure to limit or remove server vulnerabilities
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(136 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJun 6 · first

New Hampshire State AG+3d · this page

Massachusetts State AG+7d

Pattern: first filing Jun 6 (ME), last Jun 13 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/forsyth-county-georgia-20230609.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 9, 2023
Raw hash: c85e221a615ca3257cdfe20b284a00f41fc5f90ea7eaed01a2b14b4c09840c69

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityForsyth County, Georgia

Victim entityForsyth County, Georgia

Incidentdiscovered Jan 24, 2023

Stated responseLaunched an investigation to determine the nature and scope of the unauthorized activity with the assistance of Federal law enforcement and a nationally recognized digital forensics firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov