HackingEducationEducationCustomer Data InvolvedIdentity (basic)MediumContained

Albany College of Pharmacy

bd_4df0933da7f60683 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 26, 2025

Filed

Sep 8, 2025

To disclose

11 weeks

Affected · nationwide

1,6621 in this filing

Linked

9 records

Confidence

66%

Full breach record for Albany College of Pharmacy →

Albany College of Pharmacy and Health Sciences reported an external system breach (hacking) occurring between August 31 and September 14, 2024. The incident was discovered on June 26, 2025, affecting 1,662 individuals, including 1 Maine resident. Data compromised included names and other personal identifiers. The college engaged external cybersecurity professionals and offered 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d11 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 299 days

discovery → filing · 11 weeks / 74 days

Aug 31, 2024

Begins

Jun 26, 2025

Discovered

Sep 8, 2025

Filed

This filing is one of 9 records about the same incident.View merged incident

A leak claim by medusa about this victim was first seen 335 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_3fa5bcf38afe8cfb2024-09-14 · +359dVerified by operator

Regulatory filings (7) · sorted by filing gap

Nebraska State AGbd_1402ad28fe624d822025-11-21 · +74dVerified by operator
Texas State AGbd_8bd925ccdd1b9c082025-06-17 · +83dVerified
Vermont State AGbd_1340b023dbebb48d2025-06-16 · +84dVerified by operator
Nebraska State AGbd_99dcd1cfae53cc592025-06-16 · +84dVerified by operator

Show 3 more filings ↓up to 84d gap

Massachusetts State AGbd_ac3a3f6463b705742025-06-16 · +84dVerified
Washington State AGbd_c2257fdbf5a4d68f2025-06-16 · +84dVerified by operator
Maine State AGbd_e539f790dec34bc92025-06-16 · +84dVerified by operator

Name: Albany College of Pharmacy and Health Sciences
norm: albany college of pharmacy and health sciences
Industry: Education

Name: Albany College of Pharmacy
norm: albany college of pharmacy
Domain: acphs.edu
Industry: Education
Industry: Educationllm

Discovered: Jun 26, 2025
Breach occurred: Aug 31, 2024 – Sep 14, 2024
Undetected for: 299 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 8, 2025
Affected individuals: 1,662state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged external cybersecurity professionals
Offered 12 months of complimentary Experian Identity Works membership
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(74 days from discovery to filing)
Compliance flags: Leak >180dME AG >30d · 74d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 26, 2025
→ Filed with AG: Sep 8, 2025
74d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 26, 2025 → Filed with AG: Sep 8, 2025	74d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

Vermont State AGJun 16 · first

Nebraska State AGJun 16 · first

Massachusetts State AGJun 16 · first

Washington State AGJun 16 · first

Maine State AGJun 16 · first

Texas State AG+1d

Maine State AG+84d · this page

Nebraska State AG+158d

Pattern: first filing Jun 16 (VT), last Nov 21 (NE) — a 158-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4a0576c1-58a5-4bf0-bf0a-752008a61cd2.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2025
Raw hash: 45deaba3555c90b9f87f25151dd9e82692b3a70a993e5d9a6e50a8e809753cee

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityAlbany College of Pharmacy and Health Sciences

Victim entityAlbany College of Pharmacy

Incidentdiscovered Jun 26, 2025

Stated responseEngaged external cybersecurity professionals

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov