MalwareEducationEducationRansomwareData EncryptedTargetedAuthenticationEducationIdentity (basic)Government IDPHIHealth (basic)MediumContained

Nelson University

bd_3d2e5afda1e7a57b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 6, 2025

Filed

Jun 15, 2026

To disclose

15 months

Affected

508state residents only

Linked

8 filings

Confidence

70%

Full breach record for Nelson University →

Nelson University reported a ransomware cyberattack affecting 508 Washington residents. The incident occurred between March 21 and April 6, 2025, and was discovered on April 6, 2025. Compromised data included names, addresses, DOBs, and SSNs. The university established a toll-free response line for affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d15 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 16 days

discovery → filing · 15 months / 435 days

Mar 21, 2025

Begins

Apr 6, 2025

Discovered

Jun 15, 2026

Filed

vs. sector median

+54 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Vermont State AGbd_aa1c98edafbb525e2026-06-15Verified
Indiana State AGbd_c1b304600e8774722026-06-15Verified
California State AGbd_e1465532454defbc2026-06-15Candidate
Nebraska State AGbd_e9812cf8133aae562026-06-15Verified

Show 3 more filings ↓up to 8d gap

Massachusetts State AGbd_f8c3c664482d9e702026-06-16 · +1dVerified
Texas State AGbd_db2413ba58da03782026-06-18 · +3dVerified
New Hampshire State AGbd_2a41d405950cbea52026-06-23 · +8dVerified

Name: Nelson University
norm: nelson university
Domain: nelsonlions.com
Industry: Education

Name: Nelson University
norm: nelson university
Domain: nelsonlions.com
Industry: Education
Industry: Educationllm

Discovered: Apr 6, 2025
Breach occurred: Mar 21, 2025 – Apr 6, 2025
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 508state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDriver's licence numberDate of birthStudent ID numberHealth insurance IDMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Set up a dedicated, confidential toll-free response line
Changes made: Continually evaluate and modify practices and internal controls to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(435 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Vermont State AGJun 15 · first

Indiana State AGJun 15 · first

California State AGJun 15 · first

Nebraska State AGJun 15 · first

Washington State AGJun 15 · first · this page

Massachusetts State AG+1d

Texas State AG+3d

New Hampshire State AG+8d

Pattern: first filing Jun 15 (VT), last Jun 23 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41330.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2026
Raw hash: 339ae9cca1c51b595012bd057fd76a51e2d9eb19c19aac2800c407aaa0d03d41

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityNelson University

Victim entityNelson University

Incidentdiscovered Apr 6, 2025

Stated responseSet up a dedicated, confidential toll-free response line

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com