MalwareGovernmentGovernmentRansomwareCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Appalachian Regional Commission

bd_465cb0871721c557 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 10, 2025

Filed

Jul 16, 2025

To disclose

14 weeks

Affected

1state residents only

Linked

8 filings

Confidence

66%

Full breach record for Appalachian Regional Commission →

Appalachian Regional Commission (ARC) notified the NH Attorney General of a cybersecurity incident discovered on April 10, 2025, involving malware deployment and unauthorized data access/exfiltration. One New Hampshire resident was affected, with potential exposure of name, address, SSN, bank account/routing numbers, and medical information. ARC contained the threat, engaged forensic investigators, contacted law enforcement, and is offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d14 weeks discovery → filing

Incident timeline

discovery → filing · 14 weeks / 97 days

Apr 10, 2025

Begins

Apr 10, 2025

Discovered

Jul 16, 2025

Filed

vs. sector median

+3 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitemedusabd_3b6377441539e4122025-04-24 · +83dVerified by operator
Leak Sitemedusabd_fd86c5fa76b5eb3e2025-04-10 · +97dVerified by operator

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_07c7c538d3cc209a2025-07-15 · +1dCandidate
Nebraska State AGbd_0c6bfea17a31825a2025-07-15 · +1dVerified
Vermont State AGbd_1a0a528fe9e9caed2025-07-15 · +1dVerified by operator
Indiana State AGbd_c52276d3217148ad2025-07-15 · +1dVerified by operator

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_e3bc9e8c6362efb82025-07-15 · +1dVerified by operator

Name: Appalachian Regional Commission
norm: appalachian regional commission
Domain: arc.gov

Name: Appalachian Regional Commission
norm: appalachian regional commission
Domain: arc.gov
Industry: Governmentllm

Discovered: Apr 10, 2025
Breach occurred: Apr 10, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 15, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the Office of the New Hampshire Attorney General

During the incident: Took steps to contain the threat
Engaged a third-party forensic firm to investigate the incident and assist with remediation efforts
Contacted law enforcement
Launched a forensic investigation
Took steps to mitigate and remediate the incident and to help prevent further unauthorized activity
Changes made: Enhance its security controls and monitoring practices as appropriate, to minimize the risk of any similar event in the future
Offered 24 months of complimentary credit monitoring and identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGJul 15 · first

Nebraska State AGJul 15 · first

Vermont State AGJul 15 · first

Indiana State AGJul 15 · first

Massachusetts State AGJul 15 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/appalachian-regional-commission-20250716.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2025
Raw hash: 7923a3b3a316bf942fbba2ee76348df007094cbe18f6e12d8e9c81bcb4bc7754

Linked disclosures

Ransomware claims (2)

Regulatory filings (5) · sorted by filing gap

Reporting entityAppalachian Regional Commission

Victim entityAppalachian Regional Commission

Incidentdiscovered Apr 10, 2025

Stated responseTook steps to contain the threat

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov