Arrowhead Regional Computing Consortium

The Arrowhead Regional Computing Consortium (ARCC) suffered a data breach discovered on February 6, 2023, with public notification issued on January 11, 2024. The incident involved unauthorized access to systems, resulting in the exposure of personal information, including full names, of six Rhode Island residents. The breach highlights vulnerabilities in ARCC’s cybersecurity defenses, raising concerns over the protection of sensitive data managed by the consortium. While the exposed data appears limited to basic identifiers (e.g., names), the incident underscores risks associated with third-party service providers handling personal information. The delayed disclosure nearly a year after detection further amplifies reputational and operational risks for ARCC, potentially eroding trust among clients and stakeholders. No evidence suggests financial fraud, ransomware involvement, or large-scale data exfiltration. However, the breach serves as a reminder of the persistent threats posed by unauthorized system intrusions, even when the immediate impact appears contained. Affected individuals may face heightened risks of phishing or identity-based attacks due to the exposed details.

Source: https://ago.vermont.gov/document/2024-01-11-arrowhead-regional-computing-consortium-data-breach-notice-consumers

TPRM report: https://www.rankiteo.com/company/northeast-service-cooperative

"id": "nor729090125",
"linkid": "northeast-service-cooperative",
"type": "Breach",
"date": "2/2023",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 6,
                        'industry': 'Public Sector / IT Services',
                        'location': 'Vermont, USA',
                        'name': 'Arrowhead Regional Computing Consortium '
                                '(ARCC)',
                        'type': 'Non-profit / Government Consortium'},
                       {'customers_affected': 6,
                        'location': 'Rhode Island, USA',
                        'name': 'State of Rhode Island (Residents)',
                        'type': 'Individuals'}],
 'customer_advisories': 'Breach notification issued to affected individuals (6 '
                        'Rhode Island residents)',
 'data_breach': {'number_of_records_exposed': 6,
                 'personally_identifiable_information': ['Full names'],
                 'sensitivity_of_data': 'Moderate (includes full names)',
                 'type_of_data_compromised': ['Personal Information']},
 'date_detected': '2023-02-06',
 'date_publicly_disclosed': '2024-01-11',
 'description': 'The Vermont Office of the Attorney General reported that '
                'Arrowhead Regional Computing Consortium (ARCC) experienced a '
                'data breach involving unauthorized access. The breach '
                'included personal information such as full names of affected '
                'individuals.',
 'impact': {'data_compromised': ['Full names'],
            'identity_theft_risk': 'Potential (personal information exposed)'},
 'references': [{'source': 'Vermont Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': 'Vermont Office of the '
                                                       'Attorney General '
                                                       'notified; Rhode Island '
                                                       'residents affected may '
                                                       'trigger additional '
                                                       'state-level '
                                                       'notifications'},
 'response': {'communication_strategy': 'Public breach notification issued by '
                                        'Vermont Office of the Attorney '
                                        'General'},
 'title': 'Arrowhead Regional Computing Consortium (ARCC) Data Breach',
 'type': 'Data Breach'}