HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Jersey College

bd_a70cb89df8829594 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 25, 2023

Filed

Dec 6, 2023

To disclose

45 weeks

Affected

8state residents only

Linked

5 filings

Confidence

66%

Full breach record for Jersey College →

Jersey College notified the New Hampshire Attorney General on December 6, 2023, of a cybersecurity incident affecting approximately 8 New Hampshire residents. Unauthorized access occurred between January 11 and January 25, 2023. The college determined that personal information, including names and Social Security numbers, was exfiltrated. Jersey College offered one year of credit monitoring and enhanced security measures.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d45 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 14 days

discovery → filing · 45 weeks / 315 days

Jan 11, 2023

Begins

Jan 25, 2023

Discovered

Dec 6, 2023

Filed

vs. sector median

+36 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by losttrust about this victim predates this filing by 70 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelosttrustbd_11ffd2b985a275ce2023-09-26 · +71dVerified by operator

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_ba615d1a5f7376012023-12-06Verified
Montana State AGbd_cdcb2ab7592342032023-12-06Verified by operator
Massachusetts State AGbd_5fbdfdb50bb436542023-12-08 · +2dVerified by operator

Name: Jersey College
norm: jersey college

Name: Jersey College
norm: jersey college
Industry: Educationllm

Discovered: Jan 25, 2023
Breach occurred: Jan 11, 2023 – Jan 25, 2023
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 5, 2023
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Began a comprehensive manual review of the impacted files
Provided written notification to affected residents commencing on or about December 5, 2023
Offered complimentary one-year memberships with a credit monitoring service
Advised affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Provided contact information for consumer reporting agencies and the Federal Trade Commission
Provided steps to safeguard against medical identity theft
Changes made: Implemented new, and upgraded existing, technical safeguards to improve its cybersecurity posture
Improved network monitoring and threat detection and prevention solutions and protocols
Further restricted user access in accordance with the principle of least privilege
Upgraded and/or patched hardware and software systems
Implemented additional cybersecurity training for users
Hired additional employees in the IT Department
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 45 weeks(315 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGDec 6 · first

Montana State AGDec 6 · first

New Hampshire State AGDec 6 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jersey-college-20231206.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 6, 2023
Raw hash: 603c46c114fc3305f831a605a322d7669f35bd41d87213f897339d923cf85049

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityJersey College

Victim entityJersey College

Incidentdiscovered Jan 25, 2023

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov