MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedEmploymentIdentity (basic)LowActive

The Arc of Essex County

bd_d663ef7e8d718ead · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 27, 2023

Filed

Apr 3, 2023

To disclose

9 weeks

Affected

1state residents only

Linked

5 filings

Confidence

67%

Full breach record for The Arc of Essex County →

The Arc of Essex County detected malware on its network on January 27, 2023. An unauthorized actor accessed files containing employment information and potentially other personal data. The incident affects one New Hampshire resident. The organization is offering one year of credit monitoring and is reviewing security policies. The investigation was ongoing at the time of filing.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d9 weeks discovery → filing

Incident timeline

discovery → filing · 9 weeks / 66 days

Jan 27, 2023

Discovered

Apr 3, 2023

Filed

vs. sector median

8 wks faster

This filing is one of 5 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 53 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedispossessorbd_667634452638fcc12023-02-09 · +53dVerified by operator
Leak Sitelockbit_3bd_76f72503936b9fd92023-02-09 · +53dVerified by operator

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_2e6f17930e9b14602023-03-28 · +6dVerified by operator
Vermont State AGbd_d8e494c29cd0bc732023-03-28 · +6dCandidate

Name: The Arc of Essex County
norm: the arc of essex county
Domain: arcessex.org

Name: The Arc of Essex County
norm: the arc of essex county
Domain: arcessex.org
Industry: Professional Servicesllm

Discovered: Jan 27, 2023
Materiality determined: —
Notification sent: Mar 28, 2023
Affected individuals: 1state-resident count only
Data types: EmploymentIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General

During the incident: Took immediate steps to ensure the security of its network
Promptly investigated the identified activity
Moved quickly to investigate and respond to the incident
Assess the security of Arc systems
Confirming the security of our systems
Reviewing the contents of relevant data for sensitive information
Notifying potentially affected individuals
Providing access to credit monitoring services for one (1) year, through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional cyber safeguards and security
Reviewing our policies, procedures, and processes related to the storage and access of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(66 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMar 28 · first

Vermont State AGMar 28 · first

New Hampshire State AG+6d · this page

Pattern: first filing Mar 28 (MA), last Apr 3 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/arc-essex-county-20230403.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 3, 2023
Raw hash: f776f52e750ca81d439e949825b23857f91c4d90306b39d66e07b1fa218ecc9d

Linked disclosures

Ransomware claims (2)

Regulatory filings (2) · sorted by filing gap

Reporting entityThe Arc of Essex County

Victim entityThe Arc of Essex County

Incidentdiscovered Jan 27, 2023

Stated responseTook immediate steps to ensure the security of its network

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov