HackingEducationEducationSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHigh

Butler University

bd_15379581260d3b93 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 4, 2023

Filed

Apr 11, 2024

To disclose

18 weeks

Affected · nationwide

1,8711 in this filing

Linked

6 filings

Confidence

75%

Full breach record for Butler University →3 incidents on file

Butler University reported a data breach originating from a third party, affecting 1,871 individuals, including one resident of Maine. The breach, which occurred on January 1, 2020, was discovered on December 4, 2023. The compromised data includes names and Social Security numbers. Butler University began notifying affected individuals on April 11, 2024, and offered one year of credit monitoring services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 4, 2023 → Filed with AG Apr 11, 2024129d ✗ ME AG >90d18 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1433 days

discovery → filing · 18 weeks / 129 days

Jan 1, 2020

Begins

Dec 4, 2023

Discovered

Apr 11, 2024

Filed

vs. sector median

+8 wks slower

This filing is one of 6 about the same incident.View merged incident

Part of Athletic Trainer System supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_17407291378201c42024-04-11Verified
Montana State AGbd_37489d61a71a5c3d2024-04-11Verified
New Hampshire State AGbd_6d9acc4e198e50422024-04-11Verified
Vermont State AGbd_8bfeb28f46a087f52024-04-11Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_8beb850292ded01f2024-04-12 · +1dVerified

Name: Butler University
norm: butler university
Domain: butler.edu

Name: Butler University
norm: butler university
Domain: butler.edu
Industry: Educationllm

Discovered: Dec 4, 2023
Breach occurred: Jan 1, 2020
Undetected for: 1,433 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 11, 2024
Affected individuals: 1,871state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain

Changes made: 1 Year of Credit Monitoring from Experian.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(129 days from discovery to filing)
Compliance flags: ME AG >90d · 129d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 4, 2023
→ Filed with AG: Apr 11, 2024
129d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 4, 2023 → Filed with AG: Apr 11, 2024	129d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGApr 11 · first

Montana State AGApr 11 · first

New Hampshire State AGApr 11 · first

Vermont State AGApr 11 · first

Maine State AGApr 11 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/aebbc4f8-fbd7-4a2d-991b-f1ec97032e39.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2024
Raw hash: 2e07ad5aeacfaeeb05dd6cf1e07237e152d28bdbb49f39170f31193995878e8b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityButler University

Victim entityButler University

Incidentdiscovered Dec 4, 2023

Stated response1 Year of Credit Monitoring from Experian.

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov