HackingProfessional ServicesProfessional ServicesVulnerability ExploitData ExfiltratedCustomer Data InvolvedGovernment IDFinancial accountMediumContained

The Republican Governors Association

bd_e40fa04553cd585a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 10, 2021

Filed

Sep 15, 2021

To disclose

27 weeks

Affected

4state residents only

Linked

5 filings

Confidence

66%

Full breach record for The Republican Governors Association →

The Republican Governors Association (RGA) notified the New Hampshire Attorney General of a data breach involving 4 state residents. Threat actors exploited a vulnerability in Microsoft Exchange Server to access RGA's email environment between February and March 2021. While forensic investigators could not confirm what specific data was accessed, the breach notification letter indicates that some residents' names, Social Security numbers, or payment card information may have been accessible. RGA implemented Microsoft patches, offered two years of credit monitoring, and notified the FBI and state regulators.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 37 days

discovery → filing · 27 weeks / 189 days

Feb 1, 2021

Begins

Mar 10, 2021

Discovered

Sep 15, 2021

Filed

vs. sector median

+8 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_19b6e52c5984a7112021-09-15Verified
Montana State AGbd_d1b4faf7253b34b82021-09-15Candidate
Massachusetts State AGbd_dd42f77634ba54a52021-09-15Verified
Maine State AGbd_fa1f241ce4f249052021-09-15Verified

Name: FOX ROTHSCHILD LLP
norm: fox rothschild
Domain: foxrothschild.com

Name: The Republican Governors Association
norm: the republican governors
Industry: Professional Servicesllm

Discovered: Mar 10, 2021
Breach occurred: Feb 1, 2021 – Mar 31, 2021
Undetected for: 37 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 15, 2021
Affected individuals: 4state-resident count only
Data types: Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: provided notice of this incident to other state regulators and the consumer reporting agenciesnotified the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Launched an investigation, with the assistance of cybersecurity experts
Commenced a thorough data mining effort to identify potentially impacted individuals
Worked to identify addresses, prepare statutorily compliant notification deliverables, and engage a vendor to provide call center, notification, and credit monitoring services
Completed its extensive address search on September 1, 2021
Mailed written notice of this incident to your state residents on September 15, 2021
Implemented the patches released by Microsoft and additional safeguards
Provided notice of this incident to other state regulators and the consumer reporting agencies
Notified the Federal Bureau of Investigation
Changes made: Implemented the patches released by Microsoft and additional safeguards to better protect against future incidents of this nature
Offering all potentially impacted individuals with two (2) years of complimentary credit monitoring and identity restoration services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(189 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGSep 15 · first

Montana State AGSep 15 · first

Massachusetts State AGSep 15 · first

Maine State AGSep 15 · first

New Hampshire State AGSep 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/republican-governors-association-20210915.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2021
Raw hash: 6ec9b789d4284e830cfa8e47cb5dbfe7ad3b61bd37c95a3fad1a2a220c114dc9

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityFOX ROTHSCHILD LLP

Victim entityThe Republican Governors Association

Incidentdiscovered Mar 10, 2021

Stated responseLaunched an investigation, with the assistance of cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov