MalwareEducationEducationRansomwareSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDHigh

Stetson University

bd_5b23a069a9d7519b · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 4, 2020

Filed

Oct 2, 2020

To disclose

28 days

Affected · nationwide

79,247210 in this filing

Linked

6 filings

Confidence

65%

Full breach record for Stetson University →2 incidents on file

Stetson University reported a data breach affecting 79,247 individuals due to a ransomware attack on a third-party service provider. The incident, occurring between February 7, 2020, and May 20, 2020, was discovered on September 4, 2020. The compromised data included names and Social Security numbers. Affected individuals were notified on October 2, 2020, and offered 12 months of complimentary credit monitoring services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 4, 2020 → Filed with AG Oct 2, 202028d ✓ ME AG ≤30d28 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 210 days

discovery → filing · 28 days

Feb 7, 2020

Begins

Sep 4, 2020

Discovered

Oct 2, 2020

Filed

This filing is one of 6 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_44230485330829ca2020-10-02Verified
Montana State AGbd_bcb2c4514aa6ebea2020-10-02Verified
New Hampshire State AGbd_611000f7777640c12020-10-08 · +6dVerified by operator
Massachusetts State AGbd_22af5c9dfd8abdf12020-11-03 · +32dVerified by operator

Show 1 more filing ↓up to 32d gap

California State AGbd_6d112560d028361e2020-11-03 · +32dVerified by operator

Name: Stetson University
norm: stetson university

Name: Stetson University
norm: stetson university
Industry: Educationllm

Discovered: Sep 4, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 210 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 2, 2020
Affected individuals: 79,247state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial

During the incident: Offered 12 months of complimentary credit monitoring services with Experian
Sent written notifications to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: ME AG ≤30d · 28d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 4, 2020
→ Filed with AG: Oct 2, 2020
28d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 4, 2020 → Filed with AG: Oct 2, 2020	28d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGOct 2 · first

Montana State AGOct 2 · first

Maine State AGOct 2 · first · this page

New Hampshire State AG+6d

Massachusetts State AG+32d

California State AG+32d

Pattern: first filing Oct 2 (IN), last Nov 3 (CA) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d58413e4-44da-450d-99d2-b876830697ed.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 2, 2020
Raw hash: c9e054cbba07a188a6b09e068a40baa5db0784309f5743c7eb915bb1c24b2623

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityStetson University

Victim entityStetson University

Incidentdiscovered Sep 4, 2020

Stated responseOffered 12 months of complimentary credit monitoring services with Experian

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov