HackingEducationEducationCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Concord Public Schools and Concord-Carlisle Regional School District

bd_c141f40979a4d5f5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 29, 2024

Filed

May 15, 2024

To disclose

16 days

Affected

16state residents only

Linked

6 filings

Confidence

67%

Full breach record for Concord Public Schools and Concord-Carlisle Regional School District →

Concord Public Schools and Concord-Carlisle Regional School District reported a cybersecurity incident discovered on April 29, 2024, where an unauthorized actor accessed network files. The breach potentially affected 16 New Hampshire residents, exposing PII including names, addresses, and SSNs. The district engaged a cybersecurity firm, secured the network, and offered credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 days

Apr 29, 2024

Discovered

May 15, 2024

Filed

vs. sector median

6 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_7ee7197b9d6514ae2024-05-15Candidate
Massachusetts State AGbd_e7f05a8f7cc25a0c2024-05-15Verified
Maine State AGbd_2fa754150def09982024-06-07 · +23dVerified
Vermont State AGbd_a64efe50e2c9ef642024-06-07 · +23dVerified

Show 1 more filing ↓up to 23d gap

New Hampshire State AGbd_d3b0c16f87f21f982024-06-07 · +23dCandidate

Name: Concord Public Schools and Concord-Carlisle Regional School District
norm: concord public schools and concord carlisle regional school district
Domain: concordps.org

Name: Concord Public Schools and Concord-Carlisle Regional School District
norm: concord public schools and concord carlisle regional school district
Domain: concordps.org
Industry: Educationllm

Discovered: Apr 29, 2024
Materiality determined: —
Notification sent: May 14, 2024
Affected individuals: 16state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Attorney General John M. Formella, New Hampshire Department of Justice
Initial access: valid_credentials

During the incident: CCRSD promptly took steps to secure its network
Engaged a specialized cybersecurity firm to investigate the nature and scope of the Incident
Began a time-consuming and detailed reconstruction and review of the data stored on the server
CCRSD providing affected individuals with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Changes made: Plan to enhance the security of their systems moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Maine State AGMay 15 · first

Massachusetts State AGMay 15 · first

New Hampshire State AGMay 15 · first · this page

Maine State AG+23d

Vermont State AG+23d

New Hampshire State AG+23d

Pattern: first filing May 15 (ME), last Jun 7 (NH) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/concord-public-schools-carlisle-regional-district-20240515.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 15, 2024
Raw hash: c5ad2f479a8ebf32b0761418d66fd038bf12a6dc24040e65bc33a4e358693d71

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityConcord Public Schools and Concord-Carlisle Regional School District

Victim entityConcord Public Schools and Concord-Carlisle Regional School District

Incidentdiscovered Apr 29, 2024

Stated responseCCRSD promptly took steps to secure its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov