Social EngineeringEducationEducationPhishingStolen CredentialsTargetedData ExfiltratedIdentity (basic)Government IDMediumContained

Mid-Atlantic Carpenters' Training Center

bd_e01c85aac6654fb4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 20, 2017

Filed

Dec 29, 2017

To disclose

10 weeks

Affected

6state residents only

Confidence

66%

Full breach record for Mid-Atlantic Carpenters' Training Center →

Mid-Atlantic Carpenters' Training Center (MACTC) notified the NH AG of a breach affecting 6 NH residents. An employee email account was compromised on Oct 19, 2017, likely via phishing by a hacker in Nigeria. Data accessed included names, SSNs, and driver's licenses. MACTC implemented MFA, encryption, and hired forensic investigators. Affected individuals received notice on Jan 3, 2018, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 10 weeks / 70 days

Oct 19, 2017

Begins

Oct 20, 2017

Discovered

Dec 29, 2017

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6 affectedView incident

Name: O'Donoghue & O'Donoghue LLP
norm: o donoghue o donoghue

Name: Mid-Atlantic Carpenters' Training Center
norm: mid atlantic carpenters training center
Industry: Educationllm

Discovered: Oct 20, 2017
Breach occurred: Oct 19, 2017
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jan 3, 2018
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Began working with the MACTC's information technology service provider to implement additional security measures
Implemented multi-variable email authentication
Ensuring that all email users utilize encryption software for additional data protection
Implementing additional safeguards to improve data security on our web server infrastructure
Hired a forensic technology firm to conduct a thorough investigation of the attack
Engaged a third party vendor to assist with preparing and sending notice of the breach to affected individuals
Changes made: Implemented multi-variable email authentication
Ensuring that all email users utilize encryption software for additional data protection
Implementing additional safeguards to improve data security on web server infrastructure
Increasing the MACTC's overall data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mid-atlantic-carpenters-20171229.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2017
Raw hash: 5a1241acbdb9a1ced52c479ebdb93c8bbbf83e54b1248b8c1651619bf107e23b

Reporting entityO'Donoghue & O'Donoghue LLP

Victim entityMid-Atlantic Carpenters' Training Center

Incidentdiscovered Oct 20, 2017

Stated responseBegan working with the MACTC's information technology service provider to implement additional security measures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov