MalwareGovernmentGovernmentRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Three Rivers Regional Commission

bd_9bfed9104624867f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 20, 2021

Filed

Mar 30, 2022

To disclose

36 weeks

Affected

1state residents only

Confidence

65%

Full breach record for Three Rivers Regional Commission →2 incidents on file

Three Rivers Regional Commission notified Montana DOJ of a ransomware attack occurring July 18-20, 2021. Systems were encrypted by an unknown actor. Data viewed/downloaded included names, SSNs, driver's licenses, financial/medical info. Notification mailed March 30, 2022. FBI/GBI notified. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 36 weeks / 253 days

Jul 18, 2021

Begins

Jul 20, 2021

Discovered

Mar 30, 2022

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Three Rivers Regional Commission
norm: three rivers regional commission

Name: Three Rivers Regional Commission
norm: three rivers regional commission
Industry: Governmentllm

Discovered: Jul 20, 2021
Breach occurred: Jul 18, 2021 – Jul 20, 2021
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 30, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported this event to federal and state law enforcementReported this event to the Federal Bureau of Investigation, the Georgia Bureau of Investigation, and the Georgia Emergency Management and Homeland Security Agency

During the incident: Secured our systems
Restored access to the information
Investigated what happened
Reported this event to federal and state law enforcement
Worked with data specialists to conduct a comprehensive review
Conducted a manual review of our records
Reported this event to the Federal Bureau of Investigation, the Georgia Bureau of Investigation, and the Georgia Emergency Management and Homeland Security Agency
Mailed written letters to individuals impacted by this event
Changes made: Reviewed our existing policies and procedures
Implemented additional administrative and technical safeguards
Enhance our information security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 36 weeks(253 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-47.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 30, 2022
Raw hash: d406ef7d2bef02ebc52af1fb544cc07f662e1e63c4cd6c56b652581a1b8f49f0

Reporting entityThree Rivers Regional Commission

Victim entityThree Rivers Regional Commission

Incidentdiscovered Jul 20, 2021

Stated responseSecured our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov