HackingOtherStolen CredentialsTargetedPIIIdentity (basic)LowContained

Museum of the American Revolution

bd_4ee258b43c89828d · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 22, 2020

Filed

Mar 10, 2021

To disclose

24 weeks

Affected

1scope not determined

Linked

4 filings

Confidence

66%

Full breach record for Museum of the American Revolution →

Museum of the American Revolution notified Montana residents of a data breach involving unauthorized access to a single employee email account between Sept 22 and Oct 13, 2020. The incident exposed names and other PII. The Museum engaged forensic specialists, secured the account, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 169 days

Sep 22, 2020

Begins

Sep 22, 2020

Discovered

Mar 10, 2021

Filed

vs. sector median

+16 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_358dec0b8792c92e2021-03-10Candidate
Indiana State AGbd_44f554b152062e432021-03-10Verified
Massachusetts State AGbd_acc833cc12c170fa2021-03-10Verified

Name: Museum of the American Revolution
norm: museum of the american revolution

Name: Museum of the American Revolution
norm: museum of the american revolution
Industry: Otherllm

Discovered: Sep 22, 2020
Breach occurred: Sep 22, 2020 – Oct 13, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 10, 2021
Affected individuals: 1scope not determined
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified state regulators
Initial access: valid_credentials

During the incident: Secured the email account
Engaged a third-party computer forensic specialist
Performed a comprehensive review of all information stored in the email account
Conducted a thorough manual review of our records to determine contact information for potentially impacted individuals
Notified state regulators
Changes made: Reviewed and enhanced our policies and procedures with additional safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGMar 10 · first

Indiana State AGMar 10 · first

Massachusetts State AGMar 10 · first

Montana State AGMar 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/musSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 10, 2021
Raw hash: 8bdadbdf3a071ad0322bda1802d32b9a0fdee30347397f43deb5d7517e16b16c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMuseum of the American Revolution

Victim entityMuseum of the American Revolution

Incidentdiscovered Sep 22, 2020

Stated responseSecured the email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov