On November 4, external counsel for Kearsarge Regional School District in New Hampshire notified the New Hampshire Attorney General’s Office about a data security breach. According to the notification, on August 27, the threat actor was able to access and possibly acquire a file containing information on 1,825 students enrolled in the district’s meal plan…
Category: U.S.
Evanston Township High School Defrauded Of $48,570 In Hack That Exposed 1,139 Identities
I’m backfilling a breach report from November as I just saw it now and it seems that others tracking k-12 data breaches may not have been aware of it, either. Jonah Meadows had reported that Evanston Township High School officials in Illinois were scammed out of more than $48,000 during a monthslong data breach that…
Luxemburg-Casco School District notifies employees of data breach
On November 18, 2021, Luxemburg-Casco School District in Wisconsin experienced a data security incident that resulted in unauthorized access to 1,399 individuals’ personal information involving their name in combination with social security number and financial account information without the PIN number or access code. In response to the breach, and in addition to offering those…
The Medical Review Institute of America notifies patients of ransomware incident (updated)
The Medical Review Institute of America (“MRIoA”) collects protected health information (PHI) as part of providing clinical peer review for covered entities that request it (if the patient consents to provide info for the review). MRIoA was hit with ransomware in November. And although they do not directly state that they paid ransom, it sounds…
Ninth Circuit overturns $1.7 million restitution order for Russian hacker
Maria Dinzeo reports: Russian hacker Yevgeniy Nikulin is off the hook for $1.7 million in restitution a federal judge ordered him to pay four tech companies whose user databases he breached in 2012. The Ninth Circuit overturned the award Wednesday, finding insufficient support for the amount of resources the companies claim to have spent trying to repair…
If Your Disclosure of a Data Breach Was “Late,” You May Have to Litigate
Jean E. Tomasco of Robinson & Cole writes about a breach involving an accounting firm that is a business associate to a number of covered entities. This month, the firm, Bansley & Kierner, issued a notice and started notifying individuals and HHS. But the time frame for discovery and notification has resulted in a potential…