HackingEducationEducationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHighContained

Texas Wesleyan University

bd_0f5d664addff81e3 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 6, 2023

Filed

Jul 29, 2024

To disclose

42 weeks

Affected · nationwide

2,9002 in this filing

Linked

5 records

Confidence

66%

Full breach record for Texas Wesleyan University →

Texas Wesleyan University reported a cybersecurity incident discovered on October 6, 2023, involving unauthorized access to systems. The breach potentially exposed names, addresses, dates of birth, and Social Security Numbers of up to 2,900 individuals. The university engaged forensic investigators, reset credentials, and enhanced security controls. Notices were sent in waves, with the final wave mailed on July 29, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 6, 2023 → Filed with AG Jul 29, 2024297d ⏱ ME AG >30d42 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 42 weeks / 297 days

Oct 6, 2023

Begins

Oct 6, 2023

Discovered

Jul 29, 2024

Filed

This filing is one of 5 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_e514341c78236cc62023-11-25 · +246dVerified by operator

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_74a5812548adb5ed2024-02-12 · +168dCandidate
Massachusetts State AGbd_d12ddf10fe3107b82024-01-30 · +181dVerified by operator
Montana State AGbd_0e17c2357de3c9972023-11-20 · +252dVerified by operator

Name: Wilson Elser Moskowitz Edelman and Dicker LLP
norm: wilson elser moskowitz edelman and dicker
Domain: txwes.edu

Name: Texas Wesleyan University
norm: texas wesleyan university
Domain: txwes.edu
Industry: Educationllm

Discovered: Oct 6, 2023
Breach occurred: Oct 6, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 29, 2024
Affected individuals: 2,900state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Disconnected all access to the network
Engaged a specialized third-party cybersecurity firm and IT personnel to assist with securing the environment
Conducted a comprehensive forensic investigation
Notified the potentially affected individuals
Offered 12 months of complimentary credit monitoring and identity theft restoration services through CyberScout
Changes made: Implementing an organization-wide credential rest of all community users
Increasing the minimum password length to 14 characters
Hardening firewall rules to strict explicit assignments for all inbound and outbound internet traffic
Adding WAF (Web Application Firewall) and secure DNS/DDOS protection
Working toward ensuring multi-factor authentication for all external access to web services
Adding additional security tools, including SentinelOne and Huntress
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(297 days from discovery to filing)
Compliance flags: ME AG >30d · 297dME resident >60d · 297d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 6, 2023
→ Filed with AG: Jul 29, 2024
297d 30 days (soft) ME AG >30d
Maine
Discovered: Oct 6, 2023
→ Notified: Jul 29, 2024
297d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 6, 2023 → Filed with AG: Jul 29, 2024	297d	30 days (soft)	ME AG >30d
Maine	Discovered: Oct 6, 2023 → Notified: Jul 29, 2024	297d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGNov 20 · first

Massachusetts State AG+71d

New Hampshire State AG+84d

Maine State AG+252d · this page

Pattern: first filing Nov 20 (MT), last Jul 29 (ME) — a 252-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/06eb8728-2dd6-4e39-93ab-4bd208225337.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 29, 2024
Raw hash: 60beabd09092d85a724477ff5008b4ac6e73d45c4406d6566957dd440ccfcbad

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityWilson Elser Moskowitz Edelman and Dicker LLP

Victim entityTexas Wesleyan University

Incidentdiscovered Oct 6, 2023

Stated responseDisconnected all access to the network

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov