MalwareEducationEducationRansomwareData EncryptedData ExfiltratedIdentity (basic)Government IDMediumContained

City College

bd_7738cb44088635cb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 16, 2021

Filed

Nov 10, 2021

To disclose

12 weeks

Affected

6state residents only

Linked

5 filings

Confidence

67%

Full breach record for City College →

City College, an educational network in Florida, notified the New Hampshire Attorney General of a ransomware incident discovered on August 16, 2021. The breach potentially exposed the personal information (names, SSNs, DOBs, addresses) of six New Hampshire residents. City College engaged forensic experts, restored systems, and confirmed deletion of exfiltrated data. Notifications were mailed to affected individuals on November 11, 2021, offering one year of credit monitoring. Remediation included implementing MFA and enhancing security policies.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 86 days

Aug 16, 2021

Discovered

Nov 10, 2021

Filed

vs. sector median

+2 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_981815f84c1845bc2021-11-10Candidate
Massachusetts State AGbd_d46c7279255d45042021-11-10Verified
Montana State AGbd_08d2dc1422fc01d62021-11-11 · +1dVerified
Indiana State AGbd_976e6e57c5ac3d112021-11-11 · +1dVerified

Name: Whiteford, Taylor & Preston LLP
norm: whiteford taylor preston
Domain: whitefordlaw.com

Name: City College
norm: city college
Industry: Educationllm

Discovered: Aug 16, 2021
Materiality determined: —
Notification sent: Nov 11, 2021
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified applicable government regulators, officials, and Attorneys General

During the incident: Engaged third-party forensic and incident response experts
Secured and safely restored systems and operations
Retrieved and confirmed deletion of the information that was obtained
Notified the three major credit reporting agencies
Notified applicable government regulators, officials, and Attorneys General
Mailed written notification to potentially affected New Hampshire residents
Changes made: Implementing MFA across its enterprise
Minimizing access to sensitive records to only certain individuals
Employing Microsoft Advanced Threat Analytics
Putting in place audits for staff and end points using Microsoft Intune and Azure Activity directory
Enhancing security for mobile devices
Further employee training on cybersecurity best practices
Reviewing and revising cybersecurity policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGNov 10 · first

Massachusetts State AGNov 10 · first

New Hampshire State AGNov 10 · first · this page

Montana State AG+1d

Indiana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/city-college-20211110.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 10, 2021
Raw hash: 877371d77e7f62f52be3c71eb732fcf14cdcba5c4e004bb2b5f6c2f69557769d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWhiteford, Taylor & Preston LLP

Victim entityCity College

Incidentdiscovered Aug 16, 2021

Stated responseEngaged third-party forensic and incident response experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov