HackingEducationEducationStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPIILowContained
Metropolitan State University of Denver
bd_6c4b7b8eb309b348 · schema v1 · pii pii-v1
Full breach record for Metropolitan State University of Denver →Metropolitan State University of Denver (MSU Denver) discovered on January 4, 2025 that unauthorized actor(s) gained access to a limited number of MSU Denver email accounts, with the breach occurring on November 19, 2024. A total of 5,237 individuals were affected, including 1 Maine resident. MSU Denver changed passwords, secured affected accounts, and engaged a data security firm to investigate. No identity theft or fraud was reported. Consumer notification was sent on May 12, 2025.
Maine clockDiscovered Jan 4, 2025 → Filed with AG May 12, 2025128d ✗ ME AG >90d18 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_8e766459601ee354Indiana State AGfiled 2025-05-12Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5c52c417-a596-4d5c-9564-cff6f48ab524.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 12, 2025
- Raw hash
- 1c6797faad343b1f656f518a4b5a91d6b6adaca857af0a3a10c6d64e482311f8
Reporting entity
- Name
- Metropolitan State University of Denvernorm: metropolitan state university of denver
- Industry
- Education
Victim entity
- Name
- Metropolitan State University of Denvernorm: metropolitan state university of denver
- Industry
- Education
- Industry
- Educationllm
Incident
- Discovered
- Jan 4, 2025
- Materiality determined
- —
- Notification sent
- May 12, 2025
- Affected individuals
- 1
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Regulator citations
- Reported to Maine Attorney GeneralReported to appropriate regulatory authorities
Compliance
- Time to disclose
- 18 weeks(128 days from discovery to filing)
- Compliance flags
- ME AG >90d · 128dME resident >60d · 128d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jan 4, 2025→ Filed with AG: May 12, 2025128d 90 days ME AG >90d Maine Discovered: Jan 4, 2025→ Notified: May 12, 2025128d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.