HackingOtherData MishandlingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Blue Mountain Community Foundation

bd_32ac6a5caf78610d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 7, 2014

Filed

Dec 1, 2014

To disclose

12 weeks

Affected

1state residents only

Confidence

67%

Full breach record for Blue Mountain Community Foundation →

Blue Mountain Community Foundation notified NH AG on Dec 1, 2014, of a breach discovered Sept 7, 2014. Third-party database FoundationSearch.com accessed and published BMCF's IRS tax exemption forms (2004-2006) containing scholarship recipients' names and SSNs. One NH resident notified. Remediation included redaction of forms from the database and cessation of collecting SSNs.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 85 days

Sep 7, 2014

Discovered

Dec 1, 2014

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Blue Mountain Community Foundation
norm: blue mountain community

Name: Blue Mountain Community Foundation
norm: blue mountain community
Industry: Otherllm

Discovered: Sep 7, 2014
Materiality determined: —
Notification sent: Dec 1, 2014
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1530 Data from Cloud Storage Object
Threat actor: Partner
Regulator citations: Notified Office of the Attorney General Michael A. Delaney
Initial access: trusted_relationship

During the incident: Launched an investigation to determine what information was contained in the specific forms that were made available
Notifying the affected scholarship recipients
Offering them one year of complimentary credit monitoring and identity theft protection services through AllClear ID
Providing dedicated call center support to answer any questions for those affected
Ensuring that the particular online database in question redacts the information on those specific tax exemption forms from its servers so that the Social Security numbers are no long visible
Taking steps to ensure other online databases that access the public IRS database redact the information from the tax exemption forms from their servers as well
Changes made: Ensuring that the particular online database in question redacts the information on those specific tax exemption forms from its servers so that the Social Security numbers are no long visible
Taking steps to ensure other online databases that access the public IRS database redact the information from the tax exemption forms from their servers as well
No longer collects this information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(85 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/blue-mountain-community-20141201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 1, 2014
Raw hash: 03535dcee4c65b798d237317022b77945c8dfe4a9c379b8c045468c056c52a18

Reporting entityBlue Mountain Community Foundation

Victim entityBlue Mountain Community Foundation

Incidentdiscovered Sep 7, 2014

Stated responseLaunched an investigation to determine what information was contained in the specific forms that were made available

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov