CHP 11-99 Foundation

On or about September 16, 2025, a CHP 11-99 Foundation staff member clicked a phishing link after an external service provider's Help Desk incorrectly cleared it as safe. The attacker gained full access to the staff member's email account, including membership applications and payment documents containing bank/credit card information, driver's license numbers, Social Security numbers, names, addresses, and email addresses. Discovery occurred on September 24, 2025, when the attacker attempted to use the compromised account to phish the Help Desk.

CHP 11-99 Foundation notified Massachusetts residents of a data security incident involving unauthorized access to a staff member's email account. The attacker accessed email folders containing membership applications, merchandise purchases, and payment forms, which included bank/credit card information, driver's license numbers, names, and addresses. The attacker subsequently used the compromised email to attempt phishing against an external service provider. The investigation is ongoing. The organization implemented MFA, changed passwords, and reviewed security protocols.

CHP 11-99 Foundation experienced a data breach after a staff member clicked a malicious link in a phishing email on September 16, 2025, despite initial clearance from a third-party help desk. The attacker gained access to the staff member's email account, potentially exposing membership applications, payment forms, bank/credit card info, SSNs, and driver's license numbers. The incident was discovered on September 24, 2025, when the attacker attempted to phish the help desk. The organization has implemented MFA, changed passwords, and engaged an incident response vendor. Identity monitoring services are being provided to affected individuals.

CHP 11-99 Foundation notified the New Hampshire Attorney General of a data incident affecting one NH resident. A staff member clicked a phishing link on September 16, 2025, after a third-party help desk incorrectly cleared it. The attacker accessed the staff member's email, exposing membership applications, payment forms (bank/credit card info), names, addresses, and SSNs. The foundation is working with incident response vendors, implemented MFA, changed passwords, and plans to change its IT provider. Notification to the resident was scheduled for January 30, 2026.