Social EngineeringGovernmentGovernmentBECStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

City of Roanoke

bd_25bffebae40ee155 · schema v1 · pii pii-v2

Severity

Medium

Discovered

May 11, 2026

Filed

Aug 17, 2026

To disclose

14 weeks

Affected

Confidence

65%

Full breach record for City of Roanoke →4 incidents on file

The City of Roanoke experienced a business email compromise (BEC) resulting in unauthorized access to departmental data on May 6, 2026. The City became aware of the incident on May 11, 2026. Two potentially affected individuals were identified, with exposure of first initial, last name, and Social Security numbers. The actor's access was terminated, and third-party cybersecurity experts were engaged. The City notified the FBI and the New Hampshire Attorney General.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 14 weeks / 98 days

May 6, 2026

Begins

May 11, 2026

Discovered

Aug 17, 2026

Filed

vs. sector median

+3 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: City of Roanoke
norm: city of roanoke

Name: City of Roanoke
norm: city of roanoke
Industry: Governmentllm

Discovered: May 11, 2026
Breach occurred: May 6, 2026
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 1, 2026
Affected individuals: 2nationwide
Data types: Identity (basic)Government ID
Attack vector: Unknown
MITRE ATT&CK: T1566 Phishing
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney GeneralNotified the FBI Cyber Division
Initial access: phishing_link

During the incident: Engaged third-party cybersecurity experts to investigate the incident
Secured personal information and protected the City's network from compromise
Notified law enforcement
Terminated the malicious actor's access
Engaged a leading security service provider to monitor our network
Reviewed our system's architecture
Changes made: Implemented stronger policies to prevent future attacks
Implemented additional security measures designed to further protect the privacy of our citizens and staff
Reviewing policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/city-roanoke-va-20260817.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2026
Raw hash: ff8c87464e0924a56d760a40b4a97e83f992c7c48e5d5a66a3894b0f00642cea

Reporting entityCity of Roanoke

Victim entityCity of Roanoke

Incidentdiscovered May 11, 2026

Stated responseEngaged third-party cybersecurity experts to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov