Social EngineeringOtherPhishingStolen CredentialsBECMulti-Stage ChainData ExfiltratedCustomer Data InvolvedCredentialsPIIEmploymentLowContained

THE BALTIMORE MUSEUM OF ART, INC.

bd_7d2c973969ec3837 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 28, 2020

Filed

May 11, 2020

To disclose

13 days

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for THE BALTIMORE MUSEUM OF ART, INC. →2 incidents on file

The Baltimore Museum of Art notified the NH AG of a security event where unauthorized third parties accessed employee email accounts using stolen credentials between April 27-28, 2020. The attacker sent phishing emails to harvest Office 365 credentials and attempted to run a fake payroll, which was stopped by the payroll provider. One NH resident was affected. BMA reset passwords, enabled MFA, and provided credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 13 days

Apr 27, 2020

Begins

Apr 28, 2020

Discovered

May 11, 2020

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_6aa044046b048bde2020-05-07 · +4dVerified
Indiana State AGbd_b3d6b9852db97a6d2020-05-07 · +4dVerified

Name: Shawe Rosenthal LLP
norm: shawe rosenthal

Name: THE BALTIMORE MUSEUM OF ART, INC.
norm: the baltimore museum of art
Industry: Otherllm

Discovered: Apr 28, 2020
Breach occurred: Apr 27, 2020 – Apr 28, 2020
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: May 5, 2020
Affected individuals: 1state-resident count only
Data types: CredentialsPIIEmployment
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Maryland Attorney General’s officeNotified FBINotified IRSNotified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Initiated a forced logout for the affected employees on all devices
Reset passwords for affected employees
Added multi-factor authentication to affected users' accounts
Working with Microsoft support on tracing the exact time the accounts were exposed
Updating Outlook security across all applications
Notifying the Maryland Attorney General’s office, the FBI, and the IRS
Offering complimentary one-year membership in credit monitoring and theft protection services through NortonLifeLock
Changes made: Applying multi-factor authentication to all email accounts
Improving Office 365 Advanced Threat Protection email filtering
Scheduling additional staff security training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMay 7 · first

Indiana State AGMay 7 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/baltimore-museum-art-20200511.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2020
Raw hash: 4f0fb6b1d290c0527d959e357e52708b635605ae3b2b0f7f4c640766f00902ac

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityShawe Rosenthal LLP

Victim entityTHE BALTIMORE MUSEUM OF ART, INC.

Incidentdiscovered Apr 28, 2020

Stated responseInitiated a forced logout for the affected employees on all devices

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov