UnknownEducationEducationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Rectory School

bd_3cea1b441e0f5bbb · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 9, 2026

To disclose

—

Affected

12state residents only

Linked

4 filings

Confidence

66%

Full breach record for Rectory School →

Rectory School experienced a network disruption on September 14, 2025, leading to the unauthorized acquisition of certain files. An investigation determined that personal information, including names, Social Security numbers, and driver's license/state ID numbers, may have been involved. Approximately 12 New Hampshire residents were affected. The school engaged independent cybersecurity experts, secured its network, and offered identity protection services to affected individuals. Notification letters were mailed on July 9, 2026.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Sep 14, 2025

Begins

Jul 9, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 303 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteqilinbd_b58db4b201de43202025-09-09 · +303dVerified by operator

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_9b5613d6b7a16e932026-07-10 · +1dVerified by operator
Massachusetts State AGbd_9cf59cf9b6dea21e2026-07-21 · +12dVerified by operator

Name: Rectory School
norm: rectory school
Domain: rectoryschool.org

Name: Rectory School
norm: rectory school
Domain: rectoryschool.org
Industry: Educationllm

Discovered: —
Breach occurred: Sep 14, 2025
Materiality determined: —
Notification sent: Jul 9, 2026
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unknown
Regulator citations: Notified the New Hampshire Attorney General

During the incident: Initiated an investigation of the matter
Engaged independent cybersecurity experts to assist with the process
Took steps to secure its network environment
Conducted a comprehensive and time-intensive review of those files by an independent data review team
Verified the potentially affected individuals, gathered and validated contact information, and assessed the scope of the impacted information
Implemented measures to enhance the security of its environment
Provided notified individuals with information about steps they can take to protect their personal information
Offered access to complimentary identity monitoring services
Established a toll-free call center through Kroll
Changes made: Implemented measures to enhance the security of its environment in an effort to minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGJul 9 · first · this page

Vermont State AG+1d

Massachusetts State AG+12d

Pattern: first filing Jul 9 (NH), last Jul 21 (MA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rectory-school-20260709.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2026
Raw hash: 5732bf6b3e2c8566f85a5dcb0bac10ee868071d96c46c94c027b2d9d5da823d9

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityRectory School

Victim entityRectory School

IncidentUnknown

Stated responseInitiated an investigation of the matter

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov