HackingCustomer Data InvolvedPIIIDENTITY_GOVERNMENTHighContained
St. Andrew's-Sewanee School
bd_43cd7b2b2b0c0e02 · schema v1 · pii pii-v1
Full breach record for St. Andrew's-Sewanee School →St. Andrews-Sewanee School, an educational institution located in Sewanee, TN, reported an external system breach (hacking) occurring between February 7, 2020, and May 20, 2020. The breach was discovered on October 16, 2020. The incident compromised the names and Social Security Numbers of 2,928 individuals, including 5 Maine residents. The school provided written notification on January 28, 2021, and offered 24 months of credit monitoring and identity theft prevention services through CyberScout to affected individuals.
Maine clockDiscovered Oct 16, 2020 → Filed with AG Jan 28, 2021104d ✗ ME AG >90d15 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,928 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c140ac86-63a3-4224-b44d-3127ecdf4c80.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 28, 2021
- Raw hash
- 7f4a15ab7807d94328ed80a73e56fd20de9f4c78e34e9ff8a91e5374b42a7850
Reporting entity
- Name
- St. Andrew's-Sewanee Schoolnorm: st andrew s sewanee school
- Industry
- education
Victim entity
- Name
- St. Andrew's-Sewanee Schoolnorm: st andrew s sewanee school
- Industry
- education
Incident
- Discovered
- Oct 16, 2020
- Materiality determined
- —
- Notification sent
- Jan 28, 2021
- Affected individuals
- 2,928
- Data types
- PIIIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 15 weeks(104 days from discovery to filing)
- Compliance flags
- ME AG >90d · 104dME resident >60d · 104d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Oct 16, 2020→ Filed with AG: Jan 28, 2021104d 90 days ME AG >90d Maine Discovered: Oct 16, 2020→ Notified: Jan 28, 2021104d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.