HackingEducationEducationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Wilbraham and Monson Academy

bd_e41e8e2975c61b23 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 15, 2021

Filed

Aug 2, 2021

To disclose

24 weeks

Affected

16state residents only

Linked

5 filings

Confidence

66%

Full breach record for Wilbraham and Monson Academy →

Wilbraham & Monson Academy notified the NH Attorney General of an incident where unauthorized individuals potentially accessed files containing personal information of approximately 16 New Hampshire residents between February 15-16, 2021. The data included names, SSNs, driver's license numbers, and financial account numbers. The organization discovered anomalous activity on February 15, 2021, contained the threat, and engaged forensic investigators. Notification letters were sent on July 29, 2021, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 168 days

Feb 15, 2021

Begins

Feb 15, 2021

Discovered

Aug 2, 2021

Filed

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_0b892a90bfacae442021-07-29 · +4dCandidate
Montana State AGbd_160ff0a5da7d35982021-07-29 · +4dVerified by operator
Massachusetts State AGbd_41593a235f7bdbed2021-07-29 · +4dVerified
Indiana State AGbd_dd2030a7b676ae022021-07-29 · +4dVerified

Name: Wilbraham and Monson Academy
norm: wilbraham and monson academy

Name: Wilbraham and Monson Academy
norm: wilbraham and monson academy
Industry: Educationllm

Discovered: Feb 15, 2021
Breach occurred: Feb 15, 2021 – Feb 16, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 29, 2021
Affected individuals: 16state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Office of the Attorney General of New Hampshire

During the incident: Contained the threat by disabling all unauthorized access to its network
Commenced a prompt and thorough investigation
Launched an investigation in consultation with outside cybersecurity professionals
Conducted comprehensive investigation and manual document review
Providing the affected residents with written notification of this incident
Providing the residents with 12 months of credit monitoring
Advising the affected residents to always remain vigilant in reviewing financial account statements
Providing the process for placing a fraud alert and/or security freeze on their credit files
Providing the contact information for the consumer reporting agencies and the Federal Trade Commission
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(168 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGJul 29 · first

Montana State AGJul 29 · first

Massachusetts State AGJul 29 · first

Indiana State AGJul 29 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wilbraham-monson-academy-20210802.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 2, 2021
Raw hash: facfc9eb9da9818a17424c81fe3fba52a5d2136ef0e948e507f7d24d683b819a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWilbraham and Monson Academy

Victim entityWilbraham and Monson Academy

Incidentdiscovered Feb 15, 2021

Stated responseContained the threat by disabling all unauthorized access to its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov