AccidentalEducationEducationMisdeliveryEmployee Data InvolvedGovernment IDIdentity (basic)EmploymentFinancial accountMediumContained

Diman Regional Vocational Technical High School

bd_e40b17f51de4c507 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 4, 2015

Filed

May 21, 2015

To disclose

17 days

Affected

2state residents only

Confidence

66%

Full breach record for Diman Regional Vocational Technical High School →2 incidents on file

Diman Regional Vocational Technical High School inadvertently sent an email containing personal information of employees to all staff and faculty on May 4, 2015. The attachment included names, Social Security numbers, dates of birth, salary, and insurance details. The email was recalled, but some recipients forwarded it. Two New Hampshire residents were affected. The school engaged an IT consultant, purged the email from its database, and required recipients to delete copies. Credit monitoring was offered, and data loss prevention software was installed to prevent recurrence.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 days

May 4, 2015

Begins

May 4, 2015

Discovered

May 21, 2015

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Diman Regional Vocational Technical High School
norm: diman regional vocational technical high school
Domain: dimanregional.org

Name: Diman Regional Vocational Technical High School
norm: diman regional vocational technical high school
Domain: dimanregional.org
Industry: Educationllm

Discovered: May 4, 2015
Breach occurred: May 4, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 14, 2015
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)EmploymentFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unknown
Threat actor: Internal
Regulator citations: Notified the New Hampshire Attorney General

During the incident: Recalled the email that same day
Launched an investigation to confirm the nature and scope of this incident
Working with an independent IT consultant
Forensically purged the email from Diman’s email database
Requiring the email recipients confirm that all copies of the email and attachment have been deleted
Requiring any hard copies of the email and/or attachments are returned to a designated Diman staff member
Sent an email to all Diman staff disclosing this incident
Mailed notice letters to the affected individuals
Offering access to one (1) free year of credit monitoring services and identity restoration services through Experian
Providing these individuals with information on how to protect against identity theft and fraud through a confidential hotline
Changes made: Installing data loss prevention (DLP) software on the school firewall and mail server
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/diman-regional-voctech-20150521.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 21, 2015
Raw hash: 57d01a470c7c4e43bbe70fd924aa17e54e234e6368111976e8208fb177bc96c7

Reporting entityDiman Regional Vocational Technical High School

Victim entityDiman Regional Vocational Technical High School

Incidentdiscovered May 4, 2015

Stated responseRecalled the email that same day

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov