Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsMediumContained

Cincinnati State Technical Community College

bd_ac918c73ef44ed84 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 6, 2020

Filed

May 11, 2020

To disclose

5 weeks

Affected

2state residents only

Confidence

66%

Full breach record for Cincinnati State Technical Community College →2 incidents on file

Cincinnati State Technical and Community College notified the NH AG that an email phishing attack compromised employee accounts between Oct 2019 and Jan 2020. Discovered April 6, 2020, the incident exposed personal info (names, SSNs, driver's licenses, bank/card info) of 2 NH residents. No evidence of misuse. The college engaged forensic experts, notified residents, and offered 1-year credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 188 days

discovery → filing · 5 weeks / 35 days

Oct 1, 2019

Begins

Apr 6, 2020

Discovered

May 11, 2020

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Cincinnati State Technical Community College
norm: cincinnati state technical community college

Name: Cincinnati State Technical Community College
norm: cincinnati state technical community college
Industry: Educationllm

Discovered: Apr 6, 2020
Breach occurred: Oct 1, 2019 – Jan 31, 2020
Undetected for: 188 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 5, 2020
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email CollectionT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Conducted an extensive forensic investigation and reconstruction of the email boxes' content
Providing affected residents with written notification
Offering a complimentary one-year membership with a credit monitoring service
Advising affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Advising affected residents to contact their financial institutions
Providing contact information for consumer reporting agencies and the Federal Trade Commission
Setting up a dedicated and confidential toll-free response line
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cincinnati-state-technical-community-20200511.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2020
Raw hash: 22f1127766a0e24766c48dd4d97c217a58d8d9bda4b0dd55a56f37058ea50d7d

Reporting entityCincinnati State Technical Community College

Victim entityCincinnati State Technical Community College

Incidentdiscovered Apr 6, 2020

Stated responseCommenced a prompt and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov