HackingEducationEducationStolen CredentialsData ExfiltratedIdentity (basic)LowContained

SAINT XAVIER UNIVERSITY

bd_08673f526f077e6d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 1, 2023

Filed

Oct 23, 2024

To disclose

16 months

Affected

Not disclosed

Linked

7 filings

Confidence

64%

Full breach record for SAINT XAVIER UNIVERSITY →

Saint Xavier University notified consumers of unauthorized access to systems between June 29 and July 18, 2023. An actor downloaded files containing names and other data elements. The university notified law enforcement, enhanced security measures, and offered credit monitoring. Notification was sent in October 2024.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday16 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 16 months / 480 days

Jun 29, 2023

Begins

Jul 1, 2023

Discovered

Oct 23, 2024

Filed

vs. sector median

+62 wks slower

This filing is one of 7 about the same incident.View merged incident

A leak claim by alphv about this victim predates this filing by 435 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_8ccf5c8f1e8552cd2023-08-14 · +436dVerified

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_84d412a28e7d5f4d2024-10-30 · +7dVerified
Maine State AGbd_e2be20372c5a352e2024-10-30 · +7dVerified
Massachusetts State AGbd_e4a17068e5d629912024-10-31 · +8dVerified
Illinois State AGbd_688e3c00de9130292024-10-01 · +22dCandidate

Show 1 more filing ↓up to 460d gap

Pressalphvbd_1cc1cbb51e78bb882023-07-21 · +460dCandidate

Name: SAINT XAVIER UNIVERSITY
norm: saint xavier university
Domain: sxu.edu

Name: SAINT XAVIER UNIVERSITY
norm: saint xavier university
Domain: sxu.edu
Industry: Educationllm

Discovered: Jul 1, 2023
Breach occurred: Jun 29, 2023 – Jul 18, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 30, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: provided relevant updates to the SXU community as we worked to respond to this matterproviding notice of this incident to potentially impacted individuals and to relevant regulatory authorities
Initial access: valid_credentials

During the incident: Promptly notified federal law enforcement
Provided relevant updates to the SXU community
Providing notice of this incident to potentially impacted individuals and to relevant regulatory authorities
Providing you with complimentary access to credit monitoring services through IDX, a ZeroFox company
Changes made: Continue to review and, where necessary, enhance our existing policies and procedures relating to data protection and security
Implemented additional security measures to mitigate risk associated with this incident and to help minimize the reoccurrence of a similar future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(480 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

PressJul 21 · first

Illinois State AG+438d

Vermont State AG+460d · this page

Indiana State AG+467d

Maine State AG+467d

Massachusetts State AG+468d

Pattern: first filing Jul 21, last Oct 31 (MA) — a 468-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-10-23-saint-xavier-university-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 23, 2024
Raw hash: cac3571e4ff1fd1c8c9703caa3df20dc0690c685b6ea81842a8916c3d3556588

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entitySAINT XAVIER UNIVERSITY

Victim entitySAINT XAVIER UNIVERSITY

Incidentdiscovered Jul 1, 2023

Stated responsePromptly notified federal law enforcement

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov