MalwareEducationEducationRansomwareStolen CredentialsData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedEmployee Data InvolvedGovernment IDFinancial accountPIIMediumContained

Whitman-Hanson Regional School District

bd_b0ce3dbd47a2a6ee · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 28, 2022

Filed

Jan 11, 2023

To disclose

24 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Whitman-Hanson Regional School District →

Whitman-Hanson Regional School District experienced a ransomware incident on July 28, 2022, resulting in unauthorized access and potential data extraction from on-site servers. The incident affected employee data including SSNs, ACH, and W-2 information. Three New Hampshire residents were identified as impacted. Notifications were sent on January 6, 2023, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 167 days

Jul 28, 2022

Begins

Jul 28, 2022

Discovered

Jan 11, 2023

Filed

vs. sector median

+17 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_4220b9127cffc8222023-01-09 · +2dVerified
Indiana State AGbd_2e35758b613229f62023-01-06 · +5dVerified

Name: Whitman-Hanson Regional School District
norm: whitman hanson regional school district
Domain: whrsd.org

Name: Whitman-Hanson Regional School District
norm: whitman hanson regional school district
Domain: whrsd.org
Industry: Educationllm

Discovered: Jul 28, 2022
Breach occurred: Jul 28, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 6, 2023
Affected individuals: 3state-resident count only
Data types: Government IDFinancial accountPII
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified local, state police as well as the FBI and Dept. of Homeland SecurityNotified its cyber insurance carrier
Initial access: valid_credentials

During the incident: Notified local, state police as well as the FBI and Dept. of Homeland Security
Conducted a thorough investigation alongside breach counsel and forensic vendors
Notified its cyber insurance carrier
Notified local police, Massachusetts State Police, the Federal Bureau of Investigation, and the U.S. Department of Homeland Security
Collaborated and cooperated with breach counsel and forensic vendors
Changes made: Instituted mass password resets
Discussions of additional firewall and/or endpoint protection
Institution of multi-factor authentication where possible
Securing the compromised systems
Initiating an investigation into the unauthorized access to determine the root cause
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(167 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJan 6 · first

Massachusetts State AG+3d

New Hampshire State AG+5d · this page

Pattern: first filing Jan 6 (IN), last Jan 11 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/whitman-hanson-regional-school-district-20230111.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 11, 2023
Raw hash: 4a95940433ef08dd331f234b7226f722e1884c95eeb0de1ec94c5882dca45128

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWhitman-Hanson Regional School District

Victim entityWhitman-Hanson Regional School District

Incidentdiscovered Jul 28, 2022

Stated responseNotified local, state police as well as the FBI and Dept. of Homeland Security

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov