HackingEducationEducationStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

The Savannah College Of Art And Design, Inc.

bd_6f5c6ce7a7e92ada · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 22, 2022

Filed

Sep 21, 2022

To disclose

4 weeks

Affected

18state residents only

Linked

7 filings

Confidence

64%

Full breach record for The Savannah College Of Art And Design, Inc. →

The Savannah College of Art and Design, Inc. notified affected individuals of a data security incident where an unauthorized person gained access to its computer network on August 22, 2022. The incident involved personal information. The College engaged a cybersecurity firm, reported to law enforcement, and offered one year of Experian IdentityWorks services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 30 days

Aug 22, 2022

Begins

Aug 22, 2022

Discovered

Sep 21, 2022

Filed

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_1fbfee995880f00a2022-09-21Verified
New Hampshire State AGbd_34b8f401d5dd864d2022-09-21Verified
Maine State AGbd_4d98e0839991c18f2022-09-21Candidate
California State AGbd_eb968d72925d9e482022-09-21Verified

Show 2 more filings ↓up to 1d gap

Washington State AGbd_343ef8796edb131d2022-09-22 · +1dVerified
Massachusetts State AGbd_e420fec75618a3062022-09-22 · +1dVerified

Name: The Savannah College Of Art And Design, Inc.
norm: the savannah college of art and design

Name: The Savannah College Of Art And Design, Inc.
norm: the savannah college of art and design
Industry: Educationllm

Discovered: Aug 22, 2022
Breach occurred: Aug 22, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2022
Affected individuals: 18state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to law enforcement
Initial access: valid_credentials

During the incident: Took immediate action to contain the incident
Began an investigation with the assistance of a cybersecurity firm
Reported the incident to law enforcement
Offering complimentary identity theft protection services through a one-year membership with Experian IdentityWorks Credit 3B
Changes made: Enhance the security of computer systems and data to help prevent events such as this from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGSep 21 · first

New Hampshire State AGSep 21 · first

Maine State AGSep 21 · first

California State AGSep 21 · first

Montana State AGSep 21 · first · this page

Washington State AG+1d

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-578.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 21, 2022
Raw hash: 6ea53bbec0357466d30ace80def6d4e979557d53994f3cff4f0bd07f41ad9399

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityThe Savannah College Of Art And Design, Inc.

Victim entityThe Savannah College Of Art And Design, Inc.

Incidentdiscovered Aug 22, 2022

Stated responseTook immediate action to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov