MalwareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICHighContained
Riverhead Central School District
bd_c0a2cd50bb9bb3ce · schema v1 · pii pii-v1
Full breach record for Riverhead Central School District →Riverhead Central School District experienced a ransomware attack on November 9, 2021, discovered on December 3, 2021. The incident affected 22,050 individuals, including names and Social Security Numbers. The district notified affected individuals on March 22, 2022, and provided 12 months of credit monitoring and ID protection through TransUnion/IDX. Two Maine residents were specifically identified among the affected.
Maine clockDiscovered Dec 3, 2021 → Filed with AG Mar 23, 2022110d ✗ ME AG >90d16 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
A leak claim by lockbit2 about this victim predates this filing by 88 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_839dca45a9638ee4Montana State AGfiled 2022-03-22(1d gap)Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/12cdefbd-34c3-417c-8679-d072fc4c1850.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 23, 2022
- Raw hash
- 907d4cafcc29e1bec7970dc258459d064a059b71d0313ac66cb7a7c6d9d6e04b
Reporting entity
- Name
- Riverhead Central School Districtnorm: riverhead central school district
- Domain
- riverhead.net
Victim entity
- Name
- Riverhead Central School Districtnorm: riverhead central school district
- Domain
- riverhead.net
Incident
- Discovered
- Dec 3, 2021
- Materiality determined
- —
- Notification sent
- Mar 22, 2022
- Affected individuals
- 22,050
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 16 weeks(110 days from discovery to filing)
- Compliance flags
- ME AG >90d · 110dME resident >60d · 109dLeak >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 3, 2021→ Filed with AG: Mar 23, 2022110d 90 days ME AG >90d Maine Discovered: Dec 3, 2021→ Notified: Mar 22, 2022109d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.