PhysicalGovernmentGovernmentTheftCustomer Data InvolvedPIIIdentity (basic)LowContained

Town of Concord

bd_c9f5e50c6ec6b04c · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 17, 2019

Filed

Sep 16, 2021

To disclose

23 months

Affected

3state residents only

Linked

3 filings

Confidence

65%

Full breach record for Town of Concord →3 incidents on file

The Town of Concord notified individuals that hard drives containing personal information (names, addresses) were stolen during disposal on October 17, 2019. The Town engaged forensic experts, blocked old passwords, and offered 12 months of Kroll identity monitoring. A criminal investigation was initiated.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 23 months / 700 days

Oct 17, 2019

Begins

Oct 17, 2019

Discovered

Sep 16, 2021

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_9943e59c373d1b0d2021-09-17 · +1dVerified
New Hampshire State AGbd_8e17cff9887e19b72021-09-22 · +6dVerified

Name: Town of Concord
norm: town of concord

Name: Town of Concord
norm: town of concord
Industry: Governmentllm

Discovered: Oct 17, 2019
Breach occurred: Oct 17, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2019
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified state regulators

During the incident: Commenced a criminal investigation
Engaged outside forensic experts
Blocked access to old passwords
Changed access procedures
Reviewed existing policies and procedures
Implemented additional safeguards
Notified state regulators
Secured the services of Kroll to provide identity monitoring
Changes made: Reviewed existing policies and procedures
Implemented additional safeguards to enhance the security of information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 months(700 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGSep 16 · first · this page

Maine State AG+1d

New Hampshire State AG+6d

Pattern: first filing Sep 16 (MT), last Sep 22 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/consumer-notification-letter-11.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2021
Raw hash: 21e74645c59c341ea2be43286c3c4050f1bc3cb5550539ee603c83254fcc550c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTown of Concord

Victim entityTown of Concord

Incidentdiscovered Oct 17, 2019

Stated responseCommenced a criminal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov