MalwareEducationEducationRansomwareStolen CredentialsData EncryptedTargetedIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

Lewis and Clark Community College

bd_98b07f674709b267 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 23, 2021

Filed

Apr 19, 2022

To disclose

21 weeks

Affected

2state residents only

Linked

6 filings

Confidence

66%

Full breach record for Lewis and Clark Community College →2 incidents on file

Lewis and Clark Community College notified the NH AG of a November 2021 ransomware incident affecting 2 NH residents. Data included names, SSNs, DOBs, driver's licenses, and health info. No evidence of misuse found. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 22 days

discovery → filing · 21 weeks / 147 days

Nov 1, 2021

Begins

Nov 23, 2021

Discovered

Apr 19, 2022

Filed

vs. sector median

+12 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_c8cb8879f5aa443d2022-04-15 · +4dVerified
Maine State AGbd_dca3f4289b7924be2022-04-15 · +4dCandidate
Massachusetts State AGbd_2aa22cd196c736df2022-04-25 · +6dVerified
Idaho State AGbd_793edf4f3fa358282022-04-25 · +6dVerified

Show 1 more filing ↓up to 6d gap

Montana State AGbd_832fcc4321479a4e2022-04-25 · +6dVerified

Name: Lewis and Clark Community College
norm: lewis and clark community college

Name: Lewis and Clark Community College
norm: lewis and clark community college
Industry: Educationllm

Discovered: Nov 23, 2021
Breach occurred: Nov 1, 2021 – Nov 30, 2021
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 15, 2022
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reporting this Incident to relevant government agencies
Initial access: valid_credentials

During the incident: Changed passwords
Retaining national privacy and security experts
Worked with a leading privacy and security firm to aid in our investigation and response
Reporting this Incident to relevant government agencies
Changes made: Implemented measures to further improve the security of systems and practices
Offering a complimentary one (1) year credit monitoring through Experian® IdentityWorksTM
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(147 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGApr 15 · first

Maine State AGApr 15 · first

New Hampshire State AG+4d · this page

Massachusetts State AG+10d

Idaho State AG+10d

Montana State AG+10d

Pattern: first filing Apr 15 (IN), last Apr 25 (MT) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lewis-clark-community-20220419.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 19, 2022
Raw hash: 49f82b3282d5c2ad2a065856907c266b4566820e3ee7132b65434430991cb426

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityLewis and Clark Community College

Victim entityLewis and Clark Community College

Incidentdiscovered Nov 23, 2021

Stated responseChanged passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov