MalwareEducationEducationRansomwareStolen CredentialsData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedEmployee Data InvolvedTargetedGovernment IDIdentity (basic)Financial accountMediumContained

Springfield Public Schools

bd_82e751b2b07c0315 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 13, 2020

Filed

Dec 10, 2020

To disclose

27 days

Affected

9state residents only

Linked

4 filings

Confidence

66%

Full breach record for Springfield Public Schools →5 incidents on file

Springfield Public Schools notified the NH Attorney General of a ransomware attack occurring between Oct 1-8, 2020. Attackers encrypted data and attempted exfiltration. 9 NH residents' SSNs and driver's licenses were accessed. SPS shut down the network, rebuilt systems from backup, and engaged law enforcement and DHS-endorsed cybersecurity partners. Notifications were mailed Dec 3, 2020, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 43 days

discovery → filing · 27 days

Oct 1, 2020

Begins

Nov 13, 2020

Discovered

Dec 10, 2020

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_b52c613430da7ccb2020-12-08 · +2dCandidate
Massachusetts State AGbd_d2a21495bef66a712020-12-04 · +6dVerified
Indiana State AGbd_45803b38d65194ab2020-12-03 · +7dVerified

Name: Bulkley Richardson
norm: bulkley richardson
Domain: bulkley.com

Name: Springfield Public Schools
norm: springfield public schools
Domain: springfieldpublicschools.com
Industry: Educationllm

Discovered: Nov 13, 2020
Breach occurred: Oct 1, 2020 – Oct 8, 2020
Undetected for: 43 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 3, 2020
Affected individuals: 9state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated CollectionT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Interrupted the incident by shutting down the network
Rebuilt servers from backup on more secure settings
Rebuilt student and staff VPN-critical systems
Continuously scanning for 'fingerprints' of the attackers
Working cooperatively with law enforcement
Working with an organization endorsed by the Department of Homeland Security
Recalibrated scanning tools to detect previously undetectable intrusions
Implemented enhanced security measures
Changes made: Rebuilt servers from backup on more secure settings
Rebuilt student and staff VPN-critical systems with significantly limited access
Recalibrated scanning tools to detect previously undetectable intrusions
Implemented enhanced security measures
Further enhanced network security
Put additional security practices and protocols in place
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGDec 3 · first

Massachusetts State AG+1d

Maine State AG+5d

New Hampshire State AG+7d · this page

Pattern: first filing Dec 3 (IN), last Dec 10 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/springfield-public-schools-20201210.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 10, 2020
Raw hash: 8d58ba1ccc54b9f2b3e7edd0739e315c382e1a08c2dfd80d15ddb07bb1b30df6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBulkley Richardson

Victim entitySpringfield Public Schools

Incidentdiscovered Nov 13, 2020

Stated responseInterrupted the incident by shutting down the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov