MalwareGovernmentGovernmentRansomwareData ExfiltratedData EncryptedRansom DemandedTargetedIdentity (basic)Government IDMediumContained

Clay County, Minnesota

bd_29884d767eda7c42 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 27, 2023

Filed

Feb 1, 2024

To disclose

14 weeks

Affected

19state residents only

Confidence

66%

Clay County, MN, filed a supplemental notice to the NH AG regarding a ransomware attack on its CaseWorks document management system. Unauthorized access occurred Oct 23-26, 2023. The incident impacted 19 New Hampshire residents (1 previously reported, 18 additional). Data involved included personal information. Remediation included MFA, vendor access updates, and enhanced security tools.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 14 weeks / 97 days

Oct 23, 2023

Begins

Oct 27, 2023

Discovered

Feb 1, 2024

Filed

vs. sector median

+3 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed19 affectedView incident

Name: Clay County, Minnesota
norm: clay county

Name: Clay County, Minnesota
norm: clay county
Industry: Governmentllm

Discovered: Oct 27, 2023
Breach occurred: Oct 23, 2023 – Oct 26, 2023
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 26, 2024
Affected individuals: 19state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementNotified the Minnesota Department of Human ServicesProviding notice to the United States Department of Health and Human Services and all appropriate state regulators

During the incident: Began working with our local information technology partner to investigate
Worked with a nationally recognized digital forensics firm to assist with the investigation
Notified federal law enforcement and the Minnesota Department of Human Services
Changes made: Implemented multi-factor authentication for any remote access to the Case Works application
Updated procedures related to external access by any vendors
Deployed security tools to enhance detection and accelerate response to cyber incidents
Enhancing technical security related to the Case Works application
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/clay-county-minnesota-20240201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 1, 2024
Raw hash: e14498eb46520c6a686df10920588ee1643af887656dc5e8622f9602fd7f221d

Reporting entityClay County, Minnesota

Victim entityClay County, Minnesota

Incidentdiscovered Oct 27, 2023

Stated responseBegan working with our local information technology partner to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov