HackingGovernmentGovernmentStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedData ExfiltratedPIIGovernment IDMediumContained

City of Wheat Ridge

bd_40ec2b8e3e4b4dfb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 29, 2022

Filed

Dec 20, 2022

To disclose

16 weeks

Affected

1state residents only

Linked

5 filings

Confidence

67%

Full breach record for City of Wheat Ridge →

Supplemental notice from City of Wheat Ridge regarding a data security incident discovered on August 29, 2022. The incident involved unauthorized access to systems, impacting personal information including names and Social Security numbers of employees and the public. One New Hampshire resident was notified on December 21, 2022. The City engaged forensic experts and the FBI, and provided identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 113 days

Aug 29, 2022

Discovered

Dec 20, 2022

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_a25b3676f3e89e522022-10-05 · +76dVerified
Montana State AGbd_8ff977e8af90c3452022-09-28 · +83dCandidate
Indiana State AGbd_ceff7d5d4bc1ef532022-09-28 · +83dVerified
New Hampshire State AGbd_d207aed9af43826b2022-09-28 · +83dVerified

Name: City of Wheat Ridge
norm: city of wheat ridge

Name: City of Wheat Ridge
norm: city of wheat ridge
Industry: Governmentllm

Discovered: Aug 29, 2022
Materiality determined: —
Notification sent: Dec 21, 2022
Affected individuals: 1state-resident count only
Data types: PIIGovernment ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to the FBIPreviously reported to your office on September 28, 2022
Initial access: valid_credentials

During the incident: Engaged independent digital forensics and incident response experts
Began working with the Federal Bureau of Investigation (the “FBI”)
Reported the incident to the FBI
Established a toll-free call center through IDX
Providing complimentary identity protection services
Changes made: Implemented enhanced safeguards to help ensure the security of its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Montana State AGSep 28 · first

Indiana State AGSep 28 · first

New Hampshire State AGSep 28 · first

Maine State AG+7d

New Hampshire State AG+83d · this page

Pattern: first filing Sep 28 (MT), last Dec 20 (NH) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/city-wheat-ridge-20221220.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2022
Raw hash: a99177955e82602a338ec38fff4e4fd2bf8ad0b4d3ea19967631aa942d8ea0ba

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCity of Wheat Ridge

Victim entityCity of Wheat Ridge

Incidentdiscovered Aug 29, 2022

Stated responseEngaged independent digital forensics and incident response experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov