HackingTelecom & MediaInformationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountLowContained

Community Phone Company

bd_db049a370753560b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 2, 2025

Filed

Aug 14, 2025

To disclose

6 weeks

Affected

18state residents only

Linked

5 filings

Confidence

65%

Full breach record for Community Phone Company →

Wallace Murry Phone Company d/b/a Community Phone notified the NH AG of a breach affecting 18 NH residents. On July 2, 2025, the company became aware of phishing emails. Investigation revealed an unauthorized person accessed a contractor's account on a third-party call recording platform using compromised credentials on July 2, 2025. Affected data may include names, email addresses, and payment information (credit card/bank account numbers). The company secured the account, implemented additional security measures, and notified affected individuals on August 5, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 43 days

Jul 2, 2025

Begins

Jul 2, 2025

Discovered

Aug 14, 2025

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_1201ea685d93f1c32025-08-13 · +1dVerified
Maine State AGbd_1665e362bab73e812025-08-13 · +1dCandidate
Montana State AGbd_1aaa56bcaa58c6152025-08-13 · +1dVerified
Indiana State AGbd_5441a4c369c7e7ad2025-08-01 · +13dVerified

Name: Community Phone Company
norm: community phone
Domain: communityphone.org

Name: Community Phone Company
norm: community phone
Domain: communityphone.org
Also named: Wallace Murry Phone Companydba oflegal entity
Community Phonedba oftrade name
Industry: Telecom & Mediallm

Discovered: Jul 2, 2025
Breach occurred: Jul 2, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 5, 2025
Affected individuals: 18state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Third party: via Community Phone contractor
Initial access: valid_credentials

During the incident: Immediately began an investigation
Took steps to limit the phishing emails’ success
Secured the contractor’s account
Began working with the third-party platform to determine what information may have been accessed
Implemented additional security measures designed to prevent the recurrence of such an incident
Continuing to evaluate its existing policies and procedures to enhance security and privacy
Provided notification to the potentially affected individuals
Changes made: Implemented additional security measures designed to prevent the recurrence of such an incident
Continuing to evaluate its existing policies and procedures to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGAug 1 · first

Massachusetts State AG+12d

Maine State AG+12d

Montana State AG+12d

New Hampshire State AG+13d · this page

Pattern: first filing Aug 1 (IN), last Aug 14 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wallace-murry-phone-community-20250814.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2025
Raw hash: bec80ba024f5740223f5831ad6fdc344d2da0c128e73bc733761d231ffae9280

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCommunity Phone Company

Victim entityCommunity Phone Company

Incidentdiscovered Jul 2, 2025

Stated responseImmediately began an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov