HackingEducationEducationVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDMediumContained

LEE UNIVERSITY

bd_300a9184d4bcd081 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 22, 2024

Filed

Mar 25, 2025

To disclose

12 months

Affected

139state residents only

Linked

15 filings

Confidence

65%

Full breach record for LEE UNIVERSITY →

Lee University notified the New Hampshire Attorney General of a data security incident discovered in March 2024 involving a third-party software vulnerability. The breach may have exposed personal information, including SSNs, of approximately 139 New Hampshire residents (students, donors, and employees). Lee University engaged cybersecurity experts, contained the incident, and offered identity theft protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d12 months discovery → filing

Incident timeline

undetected · 21 days

discovery → filing · 12 months / 368 days

Mar 1, 2024

Begins

Mar 22, 2024

Discovered

Mar 19, 2025

Scope determined

Mar 25, 2025

Filed

vs. sector median

+44 wks slower

This filing is one of 15 about the same incident.View merged incident

A leak claim by medusa about this victim predates this filing by 341 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Montana State AGbd_7e6cb9d5990cf5492025-03-25Verified
Oregon State AGbd_8cdee20d984ad4d92025-03-25Verified
Massachusetts State AGbd_04edd7df916f70a02025-03-26 · +1dVerified
Maine State AGbd_37ece777e49ea0462025-03-26 · +1dVerified

Show 6 more filings ↓up to 394d gap

Washington State AGbd_96bc7c394d2c81b32025-03-26 · +1dVerified
Washington State AGbd_b3e570950a87e26f2025-03-26 · +1dVerified
California State AGbd_d5f5a1eec1591b7c2025-03-26 · +1dVerified
Vermont State AGbd_daa4525b9e17e7cc2025-03-24 · +1dVerified
South Carolina State AGbd_999367d5f3b9dbb72025-03-31 · +6dVerified
Maryland State AGbd_81b8b7e84bde761c2026-04-23 · +394dVerified

Showing first 10 of 14 linked disclosures.

Name: LEE UNIVERSITY
norm: lee university

Name: LEE UNIVERSITY
norm: lee university
Industry: Educationllm

Discovered: Mar 22, 2024
Breach occurred: Mar 1, 2024 – Mar 31, 2024
Undetected for: 21 daysoccurrence → discovery
Materiality determined: Mar 19, 2025
Notification sent: Mar 24, 2025
Affected individuals: 139state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General John Formella, Office of the Attorney General Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Began an investigation of the matter with the assistance of engaged independent cybersecurity experts
Undertook an investigation to understand whether data was potentially involved
Offering identity theft protection services through IDX
Reviewing existing policies and procedures and implementing enhanced security measures
Changes made: Reviewing existing policies and procedures and implementing enhanced security measures to reduce the likelihood of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(368 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Vermont State AGMar 24 · first

Montana State AG+1d

Oregon State AG+1d

New Hampshire State AG+1d · this page

Massachusetts State AG+2d

Maine State AG+2d

Washington State AG+2d

California State AG+2d

South Carolina State AG+7d

Maryland State AG+395d

Pattern: first filing Mar 24 (VT), last Apr 23 (MD) — a 395-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lee-university-20250325.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2025
Raw hash: 7131936765003804496f85cd92a74a5fb0b0a0a50eaaaba075b1009b717da165

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityLEE UNIVERSITY

Victim entityLEE UNIVERSITY

Incidentdiscovered Mar 22, 2024

Stated responseBegan an investigation of the matter with the assistance of engaged independent cybersecurity experts

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov