MalwareRansomwarePhobosData ExfiltratedRansom DemandedData EncryptedCustomer Data InvolvedTargetedPHIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Athens County Board of Developmental Disabilities
bd_a777a30ec570dbfa · schema v1 · pii pii-v1
Full breach record for Athens County Board of Developmental Disabilities →Athens County Board of Developmental Disabilities experienced a ransomware attack by the Phobos actor group between May 24-25, 2024. The breach affected 4 New Hampshire residents, exposing PHI and PII. ACBDD detected the incident on May 28, 2024, took systems offline, engaged forensic investigators, and notified affected individuals on February 11, 2025, offering credit monitoring services.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_4a78f54984e91c0cIndiana State AGfiled 2025-02-11(37d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/athens-county-board-developmental-disabilities-20250320.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 20, 2025
- Raw hash
- f5b4c09f2ed42ca0f67ca6ac4e355a70a5fba8ed81891d79289c18ba9dd8025e
Reporting entity
- Name
- Athens County Board of Developmental Disabilitiesnorm: athens county board of developmental disabilities
- Domain
- athenscbdd.org
Victim entity
- Name
- Athens County Board of Developmental Disabilitiesnorm: athens county board of developmental disabilities
- Domain
- athenscbdd.org
Incident
- Discovered
- May 28, 2024
- Materiality determined
- Nov 12, 2024
- Notification sent
- Feb 11, 2025
- Affected individuals
- 4
- Data types
- PHIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1078 Valid Accounts
- Threat actor
- PhobosExternalFinancial
- Regulator citations
- Reported the incident to the Department of Health and Human Services with the Office of Civil Rights
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 42 weeks(296 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.