DisclosureLens
HackingEducationEducationCustomer Data InvolvedIdentity (basic)Financial accountLow

Lewis & Clark College

bd_555bae41e4bfd13e · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 24, 2024

Filed

Mar 22, 2024

To disclose

27 days

Affected

110scope not determined

Linked

9 filings

Confidence

50%
Full breach record for Lewis & Clark College →4 incidents on file

Lewis and Clark College reported a data breach to the Maine Attorney General, affecting 110 Maine residents. The breach, which occurred on March 3, 2023, and was discovered on February 24, 2024, was described as an external system breach or hacking incident. The compromised information includes names or other personal identifiers in combination with financial account numbers or credit/debit card numbers and their associated security codes or PINs. The college began notifying affected individuals on March 22, 2024, and is offering 12 months of credit monitoring and identity theft protection services through CyberScout via TransUnion.

Leak gap clock✗ Leak >180d27 days discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 358 days
discovery → filing · 27 days

Mar 3, 2023

Begins

Feb 24, 2024

Discovered

Mar 22, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 9 about the same incident.View merged incident
A leak claim by quantum about this victim predates this filing by 798 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Show 3 more filings ↓up to 692d gap

Filing propagation · 8 filings · 8 states

View merged incident ↗
Indiana State AGMar 22 · first
Washington State AGMar 22 · first
Montana State AGMar 22 · first
Vermont State AGMar 22 · first
California State AGMar 22 · first
Maine State AGMar 22 · first · this page
Oregon State AG+19d
Idaho State AG+692d

Pattern: first filing Mar 22 (IN), last Feb 12 (ID) — a 692-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.