MalwareEducationEducationRansomwareData EncryptedRansom DemandedIdentity (basic)Government IDFinancial accountMediumContained

Guilford Technical Community College

bd_e53dd6052b196805 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 13, 2020

Filed

Nov 9, 2020

To disclose

8 weeks

Affected

8state residents only

Linked

3 filings

Confidence

66%

Full breach record for Guilford Technical Community College →3 incidents on file

Guilford Technical Community College (GTCC) notified the New Hampshire Attorney General of a ransomware attack. The incident occurred between August 5, 2020, and September 13, 2020. The attack encrypted systems and potentially exposed personal information of 8 New Hampshire residents, including names, SSNs, medical insurance info, and financial account details. GTCC engaged the FBI and cybersecurity experts, moved systems to the cloud, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 39 days

discovery → filing · 8 weeks / 57 days

Aug 5, 2020

Begins

Sep 13, 2020

Discovered

Nov 9, 2020

Filed

vs. sector median

on median

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_34e1d618d5597c032020-11-05 · +4dCandidate
Maine State AGbd_d9d06ab471bbac1a2022-01-13 · +430dVerified

Name: FOX ROTHSCHILD LLP
norm: fox rothschild
Domain: foxrothschild.com

Name: Guilford Technical Community College
norm: guilford technical community college
Industry: education
Industry: Educationllm

Discovered: Sep 13, 2020
Breach occurred: Aug 5, 2020 – Sep 13, 2020
Undetected for: 39 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 5, 2020
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: provided notice of this incident to certain other state regulators and the consumer reporting agencies

During the incident: Launched an investigation, with the assistance of leading cybersecurity experts, the Federal Bureau of Investigation, and other state agencies
Moved its main systems and applications to a more secure cloud environment
Offering all potentially impacted individuals with two (2) years of complimentary credit monitoring and identity restoration services with Experian
Changes made: Reviewing its policies and procedures and implementing additional safeguards
Moved its main systems and applications to a more secure cloud environment
Will transition additional applications and systems to a cloud environment in the coming weeks
Introduce new technological safeguards throughout GTCC's environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Maine State AGNov 5 · first

New Hampshire State AG+4d · this page

Maine State AG+434d

Pattern: first filing Nov 5 (ME), last Jan 13 (ME) — a 434-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/guilford-technical-community-college-20201109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2020
Raw hash: 0e0269b5518824bbfb54cc32f2188d60f0de524055e3948dcd4ae74c97379453

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFOX ROTHSCHILD LLP

Victim entityGuilford Technical Community College

Incidentdiscovered Sep 13, 2020

Stated responseLaunched an investigation, with the assistance of leading cybersecurity experts, the Federal Bureau of Investigation, and other state agencies

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov