HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
Shattuck-St. Mary's School
bd_5c2b8a1a91fd1fac · schema v1 · pii pii-v1
Full breach record for Shattuck-St. Mary's School →Shattuck-St. Mary's School notified the New Hampshire Attorney General of a data security incident involving one NH resident. An unauthorized person accessed an employee email account between May 13-15, 2020, forwarding emails to an unknown address. The school discovered the breach on May 15, 2020, and confirmed on October 19, 2020, that one resident's name and SSN were exposed. Notification was mailed on January 8, 2021. The school engaged forensic investigators, secured the account, and provided one year of credit monitoring via Kroll.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_441348c8cee74601Montana State AGfiled 2021-01-08(3d gap)Candidate
- bd_b7df2fc4a2504d46Maine State AGfiled 2021-01-08(3d gap)Verified by operator
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/shattuck-st-marys-school-20210111.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 11, 2021
- Raw hash
- 56150943bd27879fc91f0a1139d4e37379e172a218115f8152baa36188b214f1
Reporting entity
- Name
- BAKER & HOSTETLER LLPnorm: baker hostetler
Victim entity
- Name
- Shattuck-St. Mary's Schoolnorm: shattuck st mary s school
- Domain
- s-sm.org
Incident
- Discovered
- May 15, 2020
- Materiality determined
- —
- Notification sent
- Jan 8, 2021
- Affected individuals
- 1
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1114 Email CollectionT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General Gordon MacDonald
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 34 weeks(241 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.