HackingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Rectory School
bd_3cea1b441e0f5bbb · schema v1 · pii pii-v1
Full breach record for Rectory School →Rectory School, a private school in Pomfret, CT, reported a data security incident to the New Hampshire Attorney General on July 9, 2026. The incident, occurring on September 14, 2025, involved unauthorized acquisition of files containing personal information (names, SSNs, driver's licenses) of approximately 12 New Hampshire residents. Rectory engaged cybersecurity experts, secured its network, and offered identity protection services via Kroll.
Leak gap clock✗ Leak >180d43 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
A leak claim by qilin about this victim predates this filing by 303 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_9b5613d6b7a16e93Vermont State AGfiled 2026-07-10(1d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/rectory-school-20260709.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 9, 2026
- Raw hash
- 5732bf6b3e2c8566f85a5dcb0bac10ee868071d96c46c94c027b2d9d5da823d9
Reporting entity
- Name
- Rectory Schoolnorm: rectory school
- Domain
- rectoryschool.org
Victim entity
- Name
- Rectory Schoolnorm: rectory school
- Domain
- rectoryschool.org
Incident
- Discovered
- Sep 14, 2025
- Materiality determined
- —
- Notification sent
- Jul 9, 2026
- Affected individuals
- 12
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 43 weeks(298 days from discovery to filing)
- Compliance flags
- Leak >180d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.