HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Gulf Coast State College (GCSC)

bd_afb654f15ad711c9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 3, 2020

Filed

Sep 30, 2020

To disclose

17 weeks

Affected

11state residents only

Linked

5 filings

Confidence

66%

Full breach record for Gulf Coast State College (GCSC) →

Gulf Coast State College notified the NH AG of unauthorized access to employee email accounts between March 31 and June 3, 2020. Discovered June 3, 2020. 11 NH residents affected; data included names and SSNs. GCSC engaged forensic firm, secured accounts, offered 1 year Kroll credit monitoring, and enhanced security protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 64 days

discovery → filing · 17 weeks / 119 days

Mar 31, 2020

Begins

Jun 3, 2020

Discovered

Sep 30, 2020

Filed

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_09fd6a24dc17d17d2020-09-29 · +1dCandidate
Indiana State AGbd_2c61a116f3b8e7bd2020-09-29 · +1dVerified
Maine State AGbd_443813483e474eea2020-09-29 · +1dVerified
Massachusetts State AGbd_fc3d2c4f71de24552020-09-29 · +1dVerified

Name: Gulf Coast State College (GCSC)
norm: gulf coast state college gcsc

Name: Gulf Coast State College (GCSC)
norm: gulf coast state college gcsc
Industry: Educationllm

Discovered: Jun 3, 2020
Breach occurred: Mar 31, 2020 – Jun 3, 2020
Undetected for: 64 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 29, 2020
Affected individuals: 11state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Took measures to secure the email account
Launched an investigation with the assistance of a professional security firm
Performed a comprehensive review of the full mailbox messages
Providing written notice to the New Hampshire residents by U.S. Mail
Offering individuals involved in the incident a complimentary one-year membership in credit monitoring and identity theft protection services through Kroll
Established a dedicated call center
Changes made: Taking steps to enhance its existing security protocols
Re-educating its staff for awareness of these types of incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGSep 29 · first

Indiana State AGSep 29 · first

Maine State AGSep 29 · first

Massachusetts State AGSep 29 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/gulf-coast-state-college-20200930.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2020
Raw hash: 91b28d4fafcc8110fb884986d50daa04689f67fac05c9b074d8ec644c3f89156

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGulf Coast State College (GCSC)

Victim entityGulf Coast State College (GCSC)

Incidentdiscovered Jun 3, 2020

Stated responseTook measures to secure the email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov