AccidentalEducationEducationMisdeliveryEmployee Data InvolvedIdentity (basic)Government IDMediumResolved

Academy of Art Unversity dba Stephens Institute

bd_5ca941b7c82c9347 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 8, 2017

Filed

Nov 17, 2017

To disclose

9 days

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Academy of Art University (dba Stephens Institute) notified employees of a data breach on November 17, 2017. On November 8, 2017, an employee mistakenly sent an internal email containing an attachment with a spreadsheet tab listing employees' first names, last names, and Social Security numbers. The email was sent only to internal Academy employees. The university recalled the email, requested deletion of the file, and offered two years of complimentary Experian identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 8, 2017 → Notified Nov 17, 20179d ✓ CA 60-day OK9 days discovery → filing

Incident timeline

discovery → filing · 9 days

Nov 8, 2017

Begins

Nov 8, 2017

Discovered

Nov 17, 2017

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_9b1983e1d1c78a7a2017-11-17Verified
Massachusetts State AGbd_fd11ef3201a810082017-11-20 · +3dVerified

Name: Academy of Art Unversity dba Stephens Institute
norm: academy of art unversity stephens institute
Domain: academyart.edu

Name: Academy of Art Unversity dba Stephens Institute
norm: academy of art unversity stephens institute
Domain: academyart.edu
Also named: Academy of Art Unversitydba oflegal entity
Stephens Institutedba oftrade name
Industry: Educationllm

Discovered: Nov 8, 2017
Breach occurred: Nov 8, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 17, 2017
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
Threat actor: Internal

During the incident: Recalled the mistakenly sent e-mail
Took additional steps to permanently delete the e-mail
Requested recipients to permanently delete the email and attached file
Providing an Experian identity-protection product at no cost
Changes made: Providing an Experian identity-protection product at no cost for two years
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: CA 60-day OK · 9d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 8, 2017
→ Notified: Nov 17, 2017
9d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 8, 2017 → Notified: Nov 17, 2017	9d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 17 · first

California State AGNov 17 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-110849
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2017
Raw hash: c6133aebdf2d434b69f5852e095805c5e6a0fef034142e5102af81b97ef5664b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAcademy of Art Unversity dba Stephens Institute

Victim entityAcademy of Art Unversity dba Stephens Institute

Incidentdiscovered Nov 8, 2017

Stated responseRecalled the mistakenly sent e-mail

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov