HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Shattuck-St. Mary's School

bd_5c2b8a1a91fd1fac · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 15, 2020

Filed

Jan 11, 2021

To disclose

34 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for Shattuck-St. Mary's School →

Shattuck-St. Mary's School notified the New Hampshire Attorney General of a data security incident involving one NH resident. An unauthorized person accessed an employee email account between May 13-15, 2020, forwarding emails to an unknown address. The school discovered the breach on May 15, 2020, and confirmed on October 19, 2020, that one resident's name and SSN were exposed. Notification was mailed on January 8, 2021. The school engaged forensic investigators, secured the account, and provided one year of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 34 weeks / 241 days

May 13, 2020

Begins

May 15, 2020

Discovered

Jan 11, 2021

Filed

vs. sector median

+27 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_07b28eb7ec4c7cc32021-01-08 · +3dVerified
Montana State AGbd_441348c8cee746012021-01-08 · +3dCandidate
Massachusetts State AGbd_74110c77a9c7a8c82021-01-08 · +3dVerified
Maine State AGbd_b7df2fc4a2504d462021-01-08 · +3dVerified by operator

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Shattuck-St. Mary's School
norm: shattuck st mary s school
Domain: s-sm.org
Industry: Educationllm

Discovered: May 15, 2020
Breach occurred: May 13, 2020 – May 15, 2020
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 8, 2021
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General Gordon MacDonald
Initial access: valid_credentials

During the incident: Took measures to secure the account
Began an investigation with the assistance of a computer forensic firm
Removed this rule [email forwarding rule] as soon as it was discovered
Reviewed all of the emails and attachments in the account to identify individuals whose information may have been accessible
Offering the New Hampshire resident one year of complimentary credit monitoring, fraud consultation, and identity theft restoration services through Kroll
Established a dedicated phone number that individuals may call with related questions
Changes made: Incorporated additional authentication measures for remote email access
Implemented additional data security measures
Provided re-education to its staff for awareness on these types of incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(241 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 8 · first

Montana State AGJan 8 · first

Massachusetts State AGJan 8 · first

Maine State AGJan 8 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shattuck-st-marys-school-20210111.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 11, 2021
Raw hash: 56150943bd27879fc91f0a1139d4e37379e172a218115f8152baa36188b214f1

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityShattuck-St. Mary's School

Incidentdiscovered May 15, 2020

Stated responseTook measures to secure the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov