MisuseEducationEducationPrivilege AbuseEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Quest Education, LLC

bd_461c1dcdeeb1b506 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 17, 2020

Filed

May 26, 2020

To disclose

6 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Quest Education, LLC →

Quest Education, LLC notified affected individuals on May 21, 2020, of a data security incident discovered on April 17, 2020. An unauthorized user accessed the customer information database using an employee's credentials. Data involved included names, addresses, SSNs, and financial account information. Quest Education engaged in an investigation, restricted access, reported to law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 39 days

Apr 17, 2020

Discovered

May 26, 2020

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_1ccbc68c338cef5f2020-05-26Verified
Massachusetts State AGbd_4cb31ef86d0f445a2020-05-26Verified

Name: Quest Education, LLC
norm: quest education

Name: Quest Education, LLC
norm: quest education
Industry: Educationllm

Discovered: Apr 17, 2020
Materiality determined: —
Notification sent: May 21, 2020
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified the Las Vegas Police Department
Initial access: insider_action

During the incident: Launched an investigation
Taken appropriate steps to prevent the unauthorized user from accessing the customer information database
Working with its database services provider to restrict unauthorized access
Reported the incident to law enforcement
Cooperate with any investigation
Offering complimentary credit and identity monitoring services for 12 months through ID Experts
Changes made: Working with its database services provider to restrict unauthorized access to avoid this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMay 26 · first

Massachusetts State AGMay 26 · first

Montana State AGMay 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-91.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 26, 2020
Raw hash: 07847fc93c34fc40599e07b124610c614e6e55341ea5857377d1b228a0c71477

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityQuest Education, LLC

Victim entityQuest Education, LLC

Incidentdiscovered Apr 17, 2020

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov