MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedTargetedPIIIdentity (basic)LowContained

The County Commissioners Association of Ohio

bd_c78acd87bc8b61ba · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 14, 2023

Filed

Feb 26, 2024

To disclose

15 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for The County Commissioners Association of Ohio →

County Commissioners Association of Ohio (CCAO) disclosed a ransomware attack on November 14, 2023, which resulted in unauthorized access and file removal. One New Hampshire resident was identified as affected. CCAO engaged forensic investigators, notified law enforcement, and offered one year of credit monitoring. Remediation includes enhanced access controls and cloud migration.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 104 days

Nov 14, 2023

Begins

Nov 14, 2023

Discovered

Feb 26, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_9967d2c98bc434ff2024-02-23 · +3dCandidate
Indiana State AGbd_c35c5ea55ff8612e2023-12-29 · +59dVerified

Name: The County Commissioners Association of Ohio
norm: the county commissioners association of ohio

Name: The County Commissioners Association of Ohio
norm: the county commissioners association of ohio
Industry: Professional Servicesllm

Discovered: Nov 14, 2023
Breach occurred: Nov 14, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 17, 2024
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Providing notice of this incident to all appropriate state regulators

During the incident: Began investigating
Securely restoring operations
Worked with a nationally recognized digital forensics firm to assist with the investigation
Notified federal law enforcement
Changes made: Working with third party experts to enhance its overall cyber security processes and procedures
Enhancing access controls relating to remote access to its network
Deploying security tools to enhance detection and accelerate response to cyber incidents
Moving on-site services to a cloud-based solution
Reducing storage of sensitive information on its network
Removing unnecessary network devices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(104 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGDec 29 · first

Montana State AG+56d

New Hampshire State AG+59d · this page

Pattern: first filing Dec 29 (IN), last Feb 26 (NH) — a 59-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/county-commissioners-association-ohio-20240226.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 26, 2024
Raw hash: 51d19e173cb420cc5c0d0ecde6577ddb53b47b3d374f105bff657930e9ffed6c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityThe County Commissioners Association of Ohio

Victim entityThe County Commissioners Association of Ohio

Incidentdiscovered Nov 14, 2023

Stated responseBegan investigating

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov