Social EngineeringOtherPhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedPIIIdentity (basic)LowContained

General Board of Higher Education and Ministry

bd_7dbba15b88d79506 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 13, 2019

Filed

May 10, 2019

To disclose

12 weeks

Affected

3state residents only

Linked

2 filings

Confidence

65%

Full breach record for General Board of Higher Education and Ministry →

General Board of Higher Education and Ministry notified individuals of a data breach involving unauthorized access to two employee email accounts. Access occurred between Jan 25 and Feb 26, 2019. The incident was discovered on Feb 13, 2019. Names of individuals were exposed. The organization engaged forensic experts, reset credentials, and provided one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 19 days

discovery → filing · 12 weeks / 86 days

Jan 25, 2019

Begins

Feb 13, 2019

Discovered

May 10, 2019

Filed

vs. sector median

+4 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_6d6a82457787f3932019-05-10Verified

Name: General Board of Higher Education and Ministry
norm: general board of higher education and ministry

Name: General Board of Higher Education and Ministry
norm: general board of higher education and ministry
Industry: Otherllm

Discovered: Feb 13, 2019
Breach occurred: Jan 25, 2019 – Feb 26, 2019
Undetected for: 19 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 10, 2019
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Immediately changed the employee’s email password credentials
Began an investigation into the incident
Conducted with the assistance of a third-party forensic expert
Undertook a time-consuming review of all the emails and attachments
Searched its internal records extensively to locate the missing addresses
Arranged for you to enroll, at no cost to you, in an online credit monitoring service (myTrueIdentity) for one year provided by TransUnion Interactive
Changes made: Working to implement additional security safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 10 · first

Montana State AGMay 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-1-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2019
Raw hash: c4592a928e22872e6db123be1469fefaacf3d540e45bc5cefa679cf0ec86291f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGeneral Board of Higher Education and Ministry

Victim entityGeneral Board of Higher Education and Ministry

Incidentdiscovered Feb 13, 2019

Stated responseImmediately changed the employee’s email password credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov