MalwareEducationEducationRansomwareStolen CredentialsLockBitLockBit 3.xData EncryptedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDFinancial accountEmploymentEducationCriticalContained

East Valley Institute of Technology

bd_d1a1fc59fd798bb8 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jan 9, 2024

Filed

Aug 13, 2024

To disclose

31 weeks

Affected · nationwide

208,71711 in this filing

Linked

3 filings

Confidence

66%

East Valley Institute of Technology (EVIT) experienced a ransomware attack on January 9, 2024, attributed to the LockBit group. Attackers used compromised credentials to access the EVIT VPN remotely, impacting virtualized server infrastructure. Approximately 208,717 individuals were potentially affected, including students, faculty, and parents. EVIT contained the incident, rebuilt servers, and engaged third-party forensic experts. Notification to New Hampshire residents occurred on August 13, 2024, after a delay in identifying specific impacted individuals via address verification. Credit monitoring and identity theft protection services were offered.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d31 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 31 weeks / 217 days

Jan 9, 2024

Begins

Jan 9, 2024

Discovered

Aug 13, 2024

Filed

vs. sector median

+21 wks slower

This filing is one of 3 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 206 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_3832ccf14d82ffef2024-01-19 · +206dVerified by operator

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_8f3cb49e2c5039732024-08-13Candidate

Name: East Valley Institute of Technology
norm: east valley institute of technology
Domain: evit.edu

Name: East Valley Institute of Technology
norm: east valley institute of technology
Domain: evit.edu
Industry: Educationllm

Discovered: Jan 9, 2024
Breach occurred: Jan 9, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 13, 2024
Affected individuals: 208,717state + nationwide
Data types: PIIIdentity (basic)Government IDFinancial accountEmploymentEducation
Attack vector: Ransomware· LockBit
MITRE ATT&CK: T1078 Valid AccountsT1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: LockBitExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice, Office of the Attorney General, Consumer Protection BureauNotified the three largest credit reporting agencies (Equifax, Experian, and TransUnion)
Initial access: valid_credentials

During the incident: Locked down VPN Access
Deployed EDR software
Implemented 24x7 monitoring for the incident
Revoked privileged user access
Changed all service account passwords
Changed all user passwords
Revoked domain trust
Performed domain cleanup
Rebuilt or replaced nineteen virtual servers
Engaged a third party specializing in network security
Contacted state, local, and federal law enforcement
Notified the three largest credit reporting agencies (Equifax, Experian, and TransUnion)
Engaged a data-mining consultant and a notification vendor
Sent email notification to all current and former students, staff, faculty, and parents with email addresses on file
Posted an additional notice of the breach on its website
Changes made: Implemented enhanced security protocols and systems
Engaged cybersecurity experts for investigation and response
Offered credit monitoring services to affected individuals
Provided regular updates and notifications to potentially impacted individuals
Offered 12 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(217 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGAug 13 · first

New Hampshire State AGAug 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/east-valley-institute-technology-20240813.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 13, 2024
Raw hash: e60fcd84c98715e23cf9a3214785d7a8e4e735aa8c0af05aef04f8e3bb5060c6

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityEast Valley Institute of Technology

Victim entityEast Valley Institute of Technology

Incidentdiscovered Jan 9, 2024

Stated responseLocked down VPN Access

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov