MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

The Arc of Essex County

bd_d8e494c29cd0bc73 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 27, 2023

Filed

Mar 28, 2023

To disclose

9 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

68%

Full breach record for The Arc of Essex County →

The Arc of Essex County notified consumers of a cybersecurity incident detected on January 27, 2023, involving malware on its network. An unauthorized actor accessed files containing employee information, including names, SSNs, driver's licenses, and financial account data. The organization secured its environment, investigated the scope, and offered one year of complimentary credit monitoring to affected employees.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 9 weeks / 60 days

Jan 27, 2023

Discovered

Mar 28, 2023

Filed

vs. sector median

9 wks faster

This filing is one of 5 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 47 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedispossessorbd_667634452638fcc12023-02-09 · +47dVerified by operator
Leak Sitelockbit_3bd_76f72503936b9fd92023-02-09 · +47dVerified by operator

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_2e6f17930e9b14602023-03-28Verified by operator
New Hampshire State AGbd_d663ef7e8d718ead2023-04-03 · +6dVerified

Name: The Arc of Essex County
norm: the arc of essex county
Domain: arcessex.org

Name: The Arc of Essex County
norm: the arc of essex county
Domain: arcessex.org
Industry: Professional Servicesllm

Discovered: Jan 27, 2023
Materiality determined: —
Notification sent: Mar 28, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External

During the incident: Promptly took steps to secure the environment
Commenced an investigation to confirm the nature and scope of this event
Confirming the security of our systems
Reviewing the contents of relevant data for sensitive information
Notifying potentially affected individuals
Offering all employees one year of complimentary access to credit monitoring services through TransUnion
Changes made: Reviewing our policies, procedures, and processes related to the storage and access of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: VT AG >14 bdayLeak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMar 28 · first

Vermont State AGMar 28 · first · this page

New Hampshire State AG+6d

Pattern: first filing Mar 28 (MA), last Apr 3 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-03-28-arc-essex-county-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2023
Raw hash: 955328d84f8e59b6b7ad5047aa089e9b15af31f2590ff28e24898c42c4b08727

Linked disclosures

Ransomware claims (2)

Regulatory filings (2) · sorted by filing gap

Reporting entityThe Arc of Essex County

Victim entityThe Arc of Essex County

Incidentdiscovered Jan 27, 2023

Stated responsePromptly took steps to secure the environment

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov