HackingGovernment IDIdentity (basic)Financial accountMediumContained

Columbia Land Conservancy, Inc.

bd_7bc511fe56ba916b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 7, 2022

Filed

Mar 21, 2022

To disclose

6 weeks

Affected

5state residents only

Linked

4 filings

Confidence

66%

Full breach record for Columbia Land Conservancy, Inc. →

Columbia Land Conservancy, Inc. notified the New Hampshire Attorney General of a security incident involving unauthorized access to computer systems between October 2 and October 20, 2021. The breach affected five New Hampshire residents, exposing names, Social Security numbers, and financial account/credit card numbers. CLC engaged a cybersecurity firm, secured systems, and provided one year of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 128 days

discovery → filing · 6 weeks / 42 days

Oct 2, 2021

Begins

Feb 7, 2022

Discovered

Mar 21, 2022

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_19d19e15b40365cf2022-03-21Candidate
Massachusetts State AGbd_7ea7159c8d1f11b22022-03-21Verified
Montana State AGbd_bb81c5403bcad4042022-03-21Verified by operator

Name: Columbia Land Conservancy, Inc.
norm: columbia land conservancy

Name: Columbia Land Conservancy, Inc.
norm: columbia land conservancy

Discovered: Feb 7, 2022
Breach occurred: Oct 2, 2021 – Oct 20, 2021
Undetected for: 128 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 21, 2022
Affected individuals: 5state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to secure the systems involved
Commenced an investigation
Engaged a cybersecurity firm to assist
Provided written notice via United States Postal Service First Class Mail to the New Hampshire residents
Offering individuals whose Social Security number may have been affected, a complimentary, one-year membership to credit monitoring and identity theft prevention services through Experian
Changes made: Implemented additional security measures to enhance the security of its network
Enhanced employee training concerning data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGMar 21 · first

Massachusetts State AGMar 21 · first

Montana State AGMar 21 · first

New Hampshire State AGMar 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/columbia-land-conservancy-20220321.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2022
Raw hash: 4e8f740dd7ceb39545de1d928ee86bcb3c2e1b634d7f3875af705dd4f9ff343a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityColumbia Land Conservancy, Inc.

Victim entityColumbia Land Conservancy, Inc.

Incidentdiscovered Feb 7, 2022

Stated responseTook steps to secure the systems involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov