MalwareEducationEducationRansomwareStolen CredentialsData EncryptedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Metropolitan Community College, Kansas City

bd_ac6099e0df6c2789 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 19, 2020

Filed

Aug 20, 2020

To disclose

9 weeks

Affected

34state residents only

Linked

4 filings

Confidence

67%

Full breach record for Metropolitan Community College, Kansas City →

Metropolitan Community College of Kansas City notified NH AG of a ransomware incident discovered June 19, 2020. Unauthorized access may have exposed student/employee PII (SSN, DL, medical, bank info). 34 NH residents affected. No evidence of data extraction or misuse. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 62 days

Jun 19, 2020

Discovered

Aug 20, 2020

Filed

vs. sector median

on median

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_234ba19b2486ac922020-08-21 · +1dVerified
Indiana State AGbd_24cf468d38eaf9aa2020-08-14 · +6dVerified
California State AGbd_cd0dcd8be25a90fd2020-08-14 · +6dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Metropolitan Community College, Kansas City
norm: metropolitan community college kansas city
Domain: mcckc.edu
Industry: Educationllm

Discovered: Jun 19, 2020
Materiality determined: —
Notification sent: Aug 14, 2020
Affected individuals: 34state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Engaged a third party to conduct a forensic investigation
Provided access to credit monitoring services for up to two years through myTrueldentity
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Working to implement additional safeguards meant to further secure data within its environment
Changes made: Implementing additional safeguards meant to further secure data within its environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGAug 14 · first

California State AGAug 14 · first

New Hampshire State AG+6d · this page

Massachusetts State AG+7d

Pattern: first filing Aug 14 (IN), last Aug 21 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/metropolitan-community-college-kansas-city-20200820.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2020
Raw hash: 86ba7b91a4dcdf239357ed25c696577f8376eb834fda848c6b9284d7cc77a2aa

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityMetropolitan Community College, Kansas City

Incidentdiscovered Jun 19, 2020

Stated responseEngaged a third party to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov