AccidentalEducationEducationMisconfigurationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

ELIZABETHTOWN COLLEGE

bd_38d47a16d117453c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 2, 2021

Filed

Dec 6, 2021

To disclose

5 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for ELIZABETHTOWN COLLEGE →

Elizabethtown College notified the NH Attorney General of a data incident discovered on Nov 2, 2021. Five files containing names, SSNs, and addresses were improperly saved in a shared network folder between Feb 2019 and Nov 2021. No evidence of theft was found. 2 NH residents were notified. Remediation included securing data and offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1005 days

discovery → filing · 5 weeks / 34 days

Feb 1, 2019

Begins

Nov 2, 2021

Discovered

Dec 6, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_20088343658921d22021-12-02 · +4dCandidate
Indiana State AGbd_8711424c44476af62021-12-02 · +4dVerified
Massachusetts State AGbd_c435c29fdc7538b02021-12-02 · +4dVerified

Name: ELIZABETHTOWN COLLEGE
norm: elizabethtown college

Name: ELIZABETHTOWN COLLEGE
norm: elizabethtown college
Industry: Educationllm

Discovered: Nov 2, 2021
Breach occurred: Feb 1, 2019 – Nov 1, 2021
Undetected for: 1,005 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 2, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Notified New Hampshire Attorney General

During the incident: Moved the files to a private folder
Retained outside counsel specializing in data security incidents and began investigating
Secured the miscategorized data
Retained Kroll, Inc. to provide notice to affected individuals
Retained Experian to provide free identity theft and credit monitoring services
Changes made: Completed review of computer systems to ensure all information was properly categorized and adequately protected
Continues taking steps to protect the privacy of members of the College’s community
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGDec 2 · first

Indiana State AGDec 2 · first

Massachusetts State AGDec 2 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/elizabethtown-college-20211206.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 6, 2021
Raw hash: aa601b4057b27c200a0430cdffe9c33724fb6cab95ccbcb50a36be82868185b9

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityELIZABETHTOWN COLLEGE

Victim entityELIZABETHTOWN COLLEGE

Incidentdiscovered Nov 2, 2021

Stated responseMoved the files to a private folder

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov