Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsMulti-Stage ChainData ExfiltratedIdentity (basic)Government IDMediumActive

Catholic Charities Boston

bd_9a42f0da8ae8373f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 17, 2021

Filed

Dec 27, 2021

To disclose

6 weeks

Affected

15state residents only

Linked

2 filings

Confidence

66%

Full breach record for Catholic Charities Boston →

Greater Boston Catholic Charities notified NH AG that a cyberattack on email accounts impacted 15 NH residents. Incident occurred ~Aug 5, 2021; discovered Nov 17, 2021. Data involved: name, address, SSN. FBI notified. Remediation: 24-month identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 104 days

discovery → filing · 6 weeks / 40 days

Aug 5, 2021

Begins

Nov 17, 2021

Discovered

Dec 27, 2021

Filed

vs. sector median

12 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_0acebf0feae563282021-12-28 · +1dVerified

Name: Catholic Charities Boston
norm: catholic charities boston
Domain: ccab.org

Name: Catholic Charities Boston
norm: catholic charities boston
Domain: ccab.org
Industry: Professional Servicesllm

Discovered: Nov 17, 2021
Breach occurred: Aug 5, 2021
Undetected for: 104 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2021
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported the Incident to the Federal Bureau of Investigation (“FBI”)
Initial access: phishing_link

During the incident: Commenced an investigation of the Incident, with assistance from third party experts
Reported the Incident to the Federal Bureau of Investigation (“FBI”)
Working with its internal Information Technology team and third-party forensics experts
Launched an in-depth investigation to determine the scope of the Incident
Engaging third-party forensic experts
Offering complimentary access to identity monitoring, fraud consultation, and identity theft restoration services
Changes made: Offering 24-months of identity theft protection services
Offering Single Bureau Credit Monitoring services at no charge
Offering identity theft protection services through First Watch Technologies (“FWT”) including 24 months of credit monitoring, a $1,000,000 insurance reimbursement policy, and fully managed id theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGDec 27 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/greater-boston-catholic-charities-20211227.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 27, 2021
Raw hash: 35a8666f9bdc4666e88ec116dd1829cf12d2b4c70d3ee40b64b1f3a74453661b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCatholic Charities Boston

Victim entityCatholic Charities Boston

Incidentdiscovered Nov 17, 2021

Stated responseCommenced an investigation of the Incident, with assistance from third party experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov