HackingEducationEducationCustomer Data InvolvedIdentity (basic)Government IDHighContained

Hartwick College

bd_0cd0210692852633 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 26, 2024

Filed

Apr 11, 2025

To disclose

24 weeks

Affected · nationwide

4,80323 in this filing

Linked

7 filings

Confidence

65%

Full breach record for Hartwick College →

Hartwick College reported an external system breach (hacking) discovered on October 26, 2024, affecting approximately 4,803 individuals, including 23 Maine residents. Personal information, including names and Social Security numbers, was potentially compromised. The college notified law enforcement, engaged forensic vendors, and provided credit monitoring services to affected individuals starting April 8, 2025.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 26, 2024 → Filed with AG Apr 11, 2025167d ✗ ME AG >90d24 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 24 weeks / 167 days

Oct 25, 2024

Begins

Oct 26, 2024

Discovered

Apr 11, 2025

Filed

vs. sector median

+15 wks slower

This filing is one of 7 about the same incident.View merged incident

A leak claim by chort about this victim predates this filing by 144 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitechortbd_0d312d19e0cdf60e2024-11-17 · +145dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_5f0a949dc18357282025-04-11Verified
New Hampshire State AGbd_61c035df1f2d90122025-04-10 · +1dVerified
Vermont State AGbd_b1776cbc7a5126512025-04-09 · +2dVerified
Nebraska State AGbd_1c5cb7b12639f4352025-04-08 · +3dCandidate

Show 1 more filing ↓up to 3d gap

Indiana State AGbd_273f83dc01a772032025-04-08 · +3dVerified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Hartwick College
norm: hartwick college
Domain: hartwick.edu
Industry: Educationllm

Discovered: Oct 26, 2024
Breach occurred: Oct 25, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Apr 8, 2025
Affected individuals: 4,803state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged a discovery vendor to perform a comprehensive review
Notified law enforcement
Reviewed its cyber security policies and procedures
Established a toll-free call center through IDX
Provided notification letters to affected individuals
Changes made: Implemented additional measures to enhance the security of the network
Restored affected systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(167 days from discovery to filing)
Compliance flags: ME AG >90d · 167dME resident >60d · 164dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 26, 2024
→ Filed with AG: Apr 11, 2025
167d 90 days ME AG >90d
Maine
Discovered: Oct 26, 2024
→ Notified: Apr 8, 2025
164d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 26, 2024 → Filed with AG: Apr 11, 2025	167d	90 days	ME AG >90d
Maine	Discovered: Oct 26, 2024 → Notified: Apr 8, 2025	164d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Nebraska State AGApr 8 · first

Indiana State AGApr 8 · first

Vermont State AG+1d

New Hampshire State AG+2d

Massachusetts State AG+3d

Maine State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8f7c122f-d1b4-4e83-b6e7-69f531f1c722.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2025
Raw hash: e0cdc920b6f1390fdbe46b9f8bcb9ebc431dc52a0f61034354dfdbd6291e5cdf

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityHartwick College

Incidentdiscovered Oct 26, 2024

Stated responseEngaged a discovery vendor to perform a comprehensive review

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov