CHP 11-99 Foundation

CHP 11-99 Foundation experienced a data breach after a staff member clicked a malicious link in a phishing email on September 16, 2025, despite initial clearance from a third-party help desk. The attacker gained access to the staff member's email account, potentially exposing membership applications, payment forms, bank/credit card info, SSNs, and driver's license numbers. The incident was discovered on September 24, 2025, when the attacker attempted to phish the help desk. The organization has implemented MFA, changed passwords, and engaged an incident response vendor. Identity monitoring services are being provided to affected individuals.

CHP 11-99 Foundation notified the New Hampshire Attorney General of a data incident affecting one NH resident. A staff member clicked a phishing link on September 16, 2025, after a third-party help desk incorrectly cleared it. The attacker accessed the staff member's email, exposing membership applications, payment forms (bank/credit card info), names, addresses, and SSNs. The foundation is working with incident response vendors, implemented MFA, changed passwords, and plans to change its IT provider. Notification to the resident was scheduled for January 30, 2026.

On or about September 16, 2025, a CHP 11-99 Foundation staff member clicked a phishing link after an external service provider's Help Desk incorrectly cleared it as safe. The attacker gained full access to the staff member's email account, including membership applications and payment documents containing bank/credit card information, driver's license numbers, Social Security numbers, names, addresses, and email addresses. Discovery occurred on September 24, 2025, when the attacker attempted to use the compromised account to phish the Help Desk.