MalwareOtherRansomwareData ExfiltratedData EncryptedRansom DemandedIdentity (basic)Government IDMediumContained

Arc Community Services Inc

bd_8afcb8ef26623bba · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 4, 2024

Filed

Dec 4, 2025

To disclose

13 months

Affected

2state residents only

Confidence

67%

Full breach record for Arc Community Services Inc →3 incidents on file

ARC Community Services reported a ransomware incident to the New Hampshire Attorney General on December 4, 2025. The breach, discovered on November 4, 2024, involved unauthorized access by an actor identified as 'INC', resulting in the encryption of files and exfiltration of PII (names and SSNs) affecting 2 NH residents. Notices were sent in October and December 2025, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d13 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 13 months / 395 days

Nov 4, 2024

Discovered

Dec 4, 2025

Filed

vs. sector median

+49 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

A leak claim by inc_ransom about this victim predates this filing by 398 days.View originating leak claim

Name: Arc Community Services Inc
norm: arc community
Domain: arccommserv.com

Name: Arc Community Services Inc
norm: arc community
Domain: arccommserv.com
Industry: Otherllm

Discovered: Nov 4, 2024
Materiality determined: —
Notification sent: Oct 6, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: filed a report to the Office for Civil Rights with the Department of Health and Human Services

During the incident: Took its systems offline
Engaged our law firm
Retained CFC Security, Inc. d/b/a/ CFC Response, a cyber forensics specialist firm
Reported the incident to law enforcement
Filed a report to the Office for Civil Rights with the Department of Health and Human Services
Provided you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no cost
Providing you with proactive fraud assistance
Set up a professional call center through TransUnion
Changes made: Reviewing its existing security policies and protections to safeguard against evolving threats moving forward
Implementing enhanced security protocols and safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(395 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/arc-community-services-20251204.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2025
Raw hash: 8b8c1ca41d54c1e50fcf3c68aa22f58769f811561ea524676a69d220e00d9dfd

Reporting entityArc Community Services Inc

Victim entityArc Community Services Inc

Incidentdiscovered Nov 4, 2024

Stated responseTook its systems offline

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov