MalwareEducationEducationRansomwareRansom DemandedData EncryptedGovernment IDPIIMediumContained

Girl Scouts of Connecticut

bd_6bb5f992ea674320 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 21, 2021

Filed

Jan 26, 2022

To disclose

14 weeks

Affected

1state residents only

Linked

3 filings

Confidence

65%

Full breach record for Girl Scouts of Connecticut →2 incidents on file

Girl Scouts of Connecticut notified individuals of a ransomware incident discovered on October 21, 2021. Unauthorized access occurred around September 30, 2021, potentially exposing Social Security numbers. The organization engaged forensic experts and the FBI, implemented enhanced security safeguards, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 21 days

discovery → filing · 14 weeks / 97 days

Sep 30, 2021

Begins

Oct 21, 2021

Discovered

Jan 26, 2022

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8c2fd0aeceb786882022-01-26Verified
Massachusetts State AGbd_54490fdfd98e99312022-02-02 · +7dVerified

Name: Girl Scouts of Connecticut
norm: girl scouts of connecticut
Domain: girlscoutsoc.org

Name: Girl Scouts of Connecticut
norm: girl scouts of connecticut
Industry: Educationllm

Discovered: Oct 21, 2021
Breach occurred: Sep 30, 2021
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 7, 2022
Affected individuals: 1state-resident count only
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Contacted the FBI
Initial access: valid_credentials

During the incident: Engaged outside counsel and third-party forensic experts to assist in the remediation efforts and conduct a thorough investigation
Contacted the FBI to seek assistance and guidance
Provided access to Single Bureau Credit Monitoring services at no charge
Provided proactive fraud assistance through Cyberscout
Changes made: Implementing additional cybersecurity safeguards
Enhancing employee cybersecurity training
Improving cybersecurity policies, procedures, and protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 26 · first

South Carolina State AGJan 26 · first · this page

Massachusetts State AG+7d

Pattern: first filing Jan 26 (MA), last Feb 2 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/GirlScoutsofConnecticut.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 26, 2022
Raw hash: 42ffcf274fe1e27a1c0225c303673d344b6fb30b903bbab487481307017d5de7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGirl Scouts of Connecticut

Victim entityGirl Scouts of Connecticut

Incidentdiscovered Oct 21, 2021

Stated responseEngaged outside counsel and third-party forensic experts to assist in the remediation efforts and conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov