HackingEducationEducationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Cambridge College

bd_1ab70eae11187ebf · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 11, 2023

To disclose

—

Affected

429state residents only

Linked

8 records

Confidence

66%

Full breach record for Cambridge College →

Cambridge College notified the NH Attorney General of unauthorized access to its network between Feb 20 and Mar 2, 2023. Approximately 429 NH residents were affected. Personal information, including names, SSNs, and financial account data for some, was exfiltrated. The investigation concluded on July 6, 2023. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Feb 20, 2023

Begins

Aug 11, 2023

Filed

This filing is one of 8 records about the same incident.View merged incident

A leak claim by monti about this victim was first seen 149 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemontibd_478065da87b1d0902023-03-15 · +149dVerified by operator

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_1b1b80c2e94bd79b2023-08-04 · +7dVerified by operator
Montana State AGbd_20a4d0e0bd5816c52023-08-04 · +7dVerified by operator
California State AGbd_779426bb4b7f7fe42023-08-04 · +7dVerified by operator
Maine State AGbd_d02e890acc344ec42023-08-04 · +7dVerified by operator

Show 2 more filings ↓up to 7d gap

Vermont State AGbd_e670e3cd233640d02023-08-04 · +7dVerified by operator
Indiana State AGbd_ecd38b291f8998a72023-08-04 · +7dVerified

Name: Cambridge College
norm: cambridge college

Name: Cambridge College
norm: cambridge college
Industry: Educationllm

Discovered: —
Breach occurred: Feb 20, 2023 – Mar 2, 2023
Materiality determined: —
Notification sent: Aug 4, 2023
Affected individuals: 429state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the Office of the Attorney General of the State of New Hampshire

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Providing the affected residents with written notification of this incident
Offering the affected residents complimentary memberships with a credit monitoring service
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Providing the affected residents with the contact information for the consumer reporting agencies and the Federal Trade Commission
Advising affected residents whose financial account information was impacted to contact their financial institutions
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >90d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Massachusetts State AGAug 4 · first

Montana State AGAug 4 · first

California State AGAug 4 · first

Maine State AGAug 4 · first

Vermont State AGAug 4 · first

Indiana State AGAug 4 · first

New Hampshire State AG+7d · this page

Pattern: first filing Aug 4 (MA), last Aug 11 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cambridge-college-20230811.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 11, 2023
Raw hash: 760995d93ec7ea8be8e53b992f43d890de35bd737f35c37717e1fa593c846e06

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityCambridge College

Victim entityCambridge College

IncidentUnknown

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov