HackingEducationEducationStolen CredentialsTargetedPIIIdentity (basic)LowContained

Suffolk University

bd_0a5ef8d86e2fc5be · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 9, 2022

Filed

Nov 30, 2022

To disclose

21 weeks

Affected

12state residents only

Linked

6 filings

Confidence

66%

Full breach record for Suffolk University →4 incidents on file

Suffolk University notified Rhode Island residents that unauthorized network access occurred on July 9, 2022. Personal information was accessed. The university engaged forensic investigators, contained the threat, and offered one year of Experian IdentityWorks credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 144 days

Jul 9, 2022

Begins

Jul 9, 2022

Discovered

Nov 30, 2022

Filed

vs. sector median

+14 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_7e160369cc05cb912022-11-30Verified
Indiana State AGbd_de24172583eb4ca32022-11-30Verified
Maine State AGbd_f9879b39d3e8beca2022-11-30Verified by operator
Massachusetts State AGbd_d8991c1e7213359a2022-12-01 · +1dVerified

Show 1 more filing ↓up to 5d gap

New Hampshire State AGbd_21109bcb644009ac2022-12-05 · +5dVerified

Name: Suffolk University
norm: suffolk university

Name: Suffolk University
norm: suffolk university
Industry: Educationllm

Discovered: Jul 9, 2022
Breach occurred: Jul 9, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 12state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Contained and secured the threat
Engaged external cybersecurity professionals
Offering a complimentary one-year membership of Experian IdentityWorks Credit 3B
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(144 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGNov 30 · first

Indiana State AGNov 30 · first

Maine State AGNov 30 · first

Montana State AGNov 30 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+5d

Pattern: first filing Nov 30 (CA), last Dec 5 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2022
Raw hash: 2dc3b3ee38821f51beb15d21b466e4bb3148f43692696f21ddfc096fae250adc

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySuffolk University

Victim entitySuffolk University

Incidentdiscovered Jul 9, 2022

Stated responseContained and secured the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov