HackingGovernmentGovernmentStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)HighContained

City of Newport, Rhode Island

bd_bceb7fd1a05f7112 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 9, 2022

Filed

Jul 22, 2022

To disclose

6 weeks

Affected · nationwide

5,5161 in this filing

Linked

4 filings

Confidence

66%

Full breach record for City of Newport, Rhode Island →

The City of Newport, RI, disclosed a data breach where unauthorized access occurred June 8-9, 2022. The incident exposed HR and benefits data, including names, SSNs, financial account numbers, health insurance info, and DOBs for approximately 5,516 Rhode Island residents. The City engaged a cybersecurity firm, notified law enforcement, and offered two years of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 6 weeks / 43 days

Jun 8, 2022

Begins

Jun 9, 2022

Discovered

Jul 22, 2022

Filed

vs. sector median

5 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_19833d65b83d95142022-07-22Verified
HHS OCRbd_2516cf104b06eb352022-07-22Verified
Maine State AGbd_773adc832263090c2022-07-22Verified

Name: City of Newport, Rhode Island
norm: city of newport rhode island

Name: City of Newport, Rhode Island
norm: city of newport rhode island
Industry: Governmentllm

Discovered: Jun 9, 2022
Breach occurred: Jun 8, 2022 – Jun 9, 2022
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 5,516state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified state and federal law enforcement
Initial access: valid_credentials

During the incident: Began an investigation
Engaged a cybersecurity firm
Notified state and federal law enforcement
Changes made: Restored the systems
Working to further enhance the security of the network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 22 · first

HHS OCRJul 22 · first

Maine State AGJul 22 · first

Montana State AGJul 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-420.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2022
Raw hash: b28870a416221b45c67a18baa49f81f9dbf048bd67a132032f8217c08794c0bd

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCity of Newport, Rhode Island

Victim entityCity of Newport, Rhode Island

Incidentdiscovered Jun 9, 2022

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov