AccidentalTechnologyInformationMisconfigurationDelayed DiscoveryGovernment IDIdentity (basic)MediumResolved

Varsity Tutors LLC

bd_3974dd33e60b4d4b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 20, 2021

Filed

Jun 3, 2022

To disclose

32 weeks

Affected

655state residents only

Linked

8 filings

Confidence

71%

Full breach record for Varsity Tutors LLC →

Varsity Tutors LLC notified Washington AG of a data event affecting 655 residents. An AWS S3 bucket was misconfigured, potentially exposing government-issued photo ID between Nov 1-6, 2021. Discovered Oct 20, 2021. Notification sent June 3, 2022. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d32 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

Nov 1, 2021

Begins

Jun 3, 2022

Filed

vs. sector median

+21 wks slower

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_13a8de957b4ea2e52022-06-03Candidate
Montana State AGbd_601e2d05841b7b9e2022-06-03Verified
Oregon State AGbd_81d4e565c2e253ea2022-06-03Verified by operator
Indiana State AGbd_98523dfca32ae99f2022-06-03Verified

Show 3 more filings ↓up to 6d gap

Massachusetts State AGbd_b6cb41de187857522022-06-03Verified
Maine State AGbd_e423db69abbd12bb2022-06-03Verified by operator
New Hampshire State AGbd_a0f3c40b2dac35b82022-06-09 · +6dVerified

Name: Varsity Tutors LLC
norm: varsity tutors
Domain: varsitytutors.com

Name: Varsity Tutors LLC
norm: varsity tutors
Domain: varsitytutors.com
Industry: Technologyllm

Discovered: Oct 20, 2021
Breach occurred: Nov 1, 2021 – Nov 6, 2021
Materiality determined: —
Notification sent: Jun 3, 2022
Affected individuals: 655state-resident count only
Data types: Government IDIdentity (basic)
Data elements: NameDriver's licence number
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Misconfiguration
MITRE ATT&CK: T1530 Data from Cloud Storage Object
Regulator citations: Provided written notice of this incident to additional relevant state regulators

During the incident: Remediated the misconfiguration
Commenced an investigation
Evaluated permissions within the storage bucket
Worked with cybersecurity specialists
Undertook a thorough and time-intensive review of the data stored within the potentially impacted S3 bucket
Provided access to credit monitoring services for twelve (12) months through Equifax
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice of this incident to additional relevant state regulators
Provided written notice of this incident to the three major credit reporting agencies
Changes made: Remediated the misconfiguration
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(226 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGJun 3 · first

Montana State AGJun 3 · first

Oregon State AGJun 3 · first

Indiana State AGJun 3 · first

Massachusetts State AGJun 3 · first

Maine State AGJun 3 · first

Washington State AGJun 3 · first · this page

New Hampshire State AG+6d

Pattern: first filing Jun 3 (CA), last Jun 9 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA11621.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2022
Raw hash: 4b8bd89fef368291cb684bbd47a60291086147c9a86737f28d22bb24ef49cb12

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityVarsity Tutors LLC

Victim entityVarsity Tutors LLC

Incidentdiscovered Oct 20, 2021

Stated responseRemediated the misconfiguration

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com