PhysicalEducationEducationTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHighContained

Champlain College Incorporated

bd_5de05f6a02cfd73e · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 18, 2013

Filed

Jul 2, 2013

To disclose

15 weeks

Affected

1,170state residents only

Linked

3 filings

Confidence

66%

Full breach record for Champlain College Incorporated →

Champlain College filed a supplemental notice with the New Hampshire Attorney General regarding a data security event involving a lost portable storage device. The device contained names and Social Security numbers of 1,170 New Hampshire residents (students and applicants). The incident was discovered on March 18, 2013. The College offered one year of identity monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 106 days

Mar 18, 2013

Discovered

Jul 2, 2013

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_89081a9597ebc7462013-06-03 · +29dVerified
New Hampshire State AGbd_104c3eac069bf32f2013-05-31 · +32dCandidate

Name: Champlain College Incorporated
norm: champlain college

Name: Champlain College Incorporated
norm: champlain college
Industry: Educationllm

Discovered: Mar 18, 2013
Materiality determined: —
Notification sent: Jul 5, 2013
Affected individuals: 1,170state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Attorney GeneralProviding written notice of this incident to other state and international regulators, and to the national consumer reporting agencies

During the incident: Commenced an internal investigation
Retained independent forensic experts, Kivu Consulting, Inc.
Retained privacy and data security legal counsel
Posted notice of this incident and Frequently Asked Questions on its website
Offered each individual access to one (1) free year of identity monitoring and restoration services
Provided each individual with information on how to protect against identity theft and fraud
Supplementing its notice of this incident to other state regulators and to the national consumer reporting agencies
Changes made: Adopting additional security collection and transfer protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(106 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

New Hampshire State AGMay 31 · first

Massachusetts State AG+3d

New Hampshire State AG+32d · this page

Pattern: first filing May 31 (NH), last Jul 2 (NH) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/champlain-college-20130702.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2013
Raw hash: 2e08c3453f510a449afdd591a424b6b4bd14d9263cf78e6a80d0dcdbe24b09c9

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityChamplain College Incorporated

Victim entityChamplain College Incorporated

Incidentdiscovered Mar 18, 2013

Stated responseCommenced an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov