MalwareEducationEducationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedTargetedGovernment IDIdentity (basic)MediumContained

Franklin and Marshall College

bd_2755c2d0cf7e1332 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 21, 2022

Filed

Aug 29, 2022

To disclose

31 weeks

Affected

2state residents only

Linked

3 filings

Confidence

67%

Full breach record for Franklin and Marshall College →2 incidents on file

Franklin College notified the New Hampshire Attorney General on August 29, 2022, of a data security incident discovered on January 21, 2022. An unknown third party conducted a data encryption attack, resulting in the exfiltration of personal information, including names and Social Security numbers, affecting two New Hampshire residents. The college engaged forensic investigators, enhanced network security, and provided 12 months of credit monitoring and identity theft recovery services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 31 weeks / 220 days

Jan 21, 2022

Discovered

Aug 29, 2022

Filed

vs. sector median

+23 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_0beb091c5f81774c2022-08-29Candidate
Indiana State AGbd_38b625e5a666d4822022-08-29Verified

Name: Franklin and Marshall College
norm: franklin and marshall college

Name: Franklin and Marshall College
norm: franklin and marshall college
Industry: Educationllm

Discovered: Jan 21, 2022
Materiality determined: —
Notification sent: Aug 29, 2022
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau

During the incident: Launched an investigation
Engaged a leading digital forensics firm and cybersecurity consultants
Engaged an independent data review team
Worked with leading cybersecurity experts to enhance the security of its network
Sent notification letter to affected individuals via first class U.S. mail
Offered twelve (12) months of credit and CyberScan monitoring
Offered a $1,000,000 insurance reimbursement policy
Offered fully managed identity theft recovery services
Staffed a call center available to answer questions and provide support
Changes made: Implemented additional security measures to enhance the security of its network
Continuously evaluating and evolving current and future cybersecurity practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(220 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGAug 29 · first

Indiana State AGAug 29 · first

New Hampshire State AGAug 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/franklin-college-20220829.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2022
Raw hash: 762a0347d3bfa89e0ddc3525187113b3e03ebe06e80955dd0a634fac9a9ea869

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFranklin and Marshall College

Victim entityFranklin and Marshall College

Incidentdiscovered Jan 21, 2022

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov