MalwareEducationEducationRansomwareData ExfiltratedRansom DemandedCustomer Data InvolvedPIIIdentity (basic)MediumActive

Nashua School District

bd_2959e5fada37481f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 28, 2023

Filed

Feb 28, 2024

To disclose

44 weeks

Affected

8,117state residents only

Linked

7 records

Confidence

66%

Full breach record for Nashua School District →

City of Nashua School District notified NH AG of a ransomware attack discovered on April 28, 2023, affecting 8,117 NH residents. Unauthorized access occurred between March 30 and April 28, 2023. Personal information including names was potentially exposed. The investigation is ongoing, and the district engaged third-party specialists, rebuilt its environment, and notified law enforcement.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d44 weeks discovery → filing

Incident timeline

undetected · 29 days

discovery → filing · 44 weeks / 306 days

Mar 30, 2023

Begins

Apr 28, 2023

Discovered

Feb 28, 2024

Filed

This filing is one of 7 records about the same incident.View merged incident

A leak claim by blacksuit about this victim was first seen 286 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblacksuitbd_2072f1e4910b73e32023-05-18 · +286dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_22fbf538ca85e3472024-02-28Verified by operator
Indiana State AGbd_3df01d72db8cdf602024-02-28Verified
Maine State AGbd_3f5dc0cdfa58cbf22024-02-28Verified by operator
Vermont State AGbd_a42ea78b7e8dde202024-02-28Verified

Show 1 more filing ↓

Montana State AGbd_d356fb91d837912e2024-02-28Candidate

Name: Nashua School District
norm: nashua school district
Domain: nashua.edu

Name: Nashua School District
norm: nashua school district
Domain: nashua.edu
Industry: Educationllm

Discovered: Apr 28, 2023
Breach occurred: Mar 30, 2023 – Apr 28, 2023
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 28, 2024
Affected individuals: 8,117state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement regarding the event

During the incident: Began working with third-party computer specialists to understand the nature and scope of the activity
Worked with subject matter specialists to rebuild its environment in a safe and secure manner
Initiated an exhaustive review of its systems to confirm the files that may have been accessed without authorization
Worked with a specialized team to conduct a comprehensive review of the impacted files
Notified federal law enforcement regarding the event
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant regulators
Providing written notice of this incident to the three major credit reporting agencies
Changes made: Implementing additional safeguards and training to its employees
Reviewing and enhancing its existing policies, procedures, and system security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(306 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGFeb 28 · first

Indiana State AGFeb 28 · first

Maine State AGFeb 28 · first

Vermont State AGFeb 28 · first

Montana State AGFeb 28 · first

New Hampshire State AGFeb 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/city-nashua-school-district-20240228.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 28, 2024
Raw hash: 9cd8fd77b638a478c53d2d3ebac665ac3c186a537e80a3475ebfd06146362dbc

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityNashua School District

Victim entityNashua School District

Incidentdiscovered Apr 28, 2023

Stated responseBegan working with third-party computer specialists to understand the nature and scope of the activity

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov