HackingEducationEducationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)MediumContained

Hartnell College

bd_7a14cb8c4464c4ea · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 2, 2022

Filed

Dec 13, 2022

To disclose

10 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Hartnell College →2 incidents on file

Hartnell Community College District experienced unauthorized access to certain network segments on October 2, 2022. The incident involved a network disruption. Investigation confirmed that personal information, including names, SSNs, driver's licenses, and medical information, may have been accessed. The college changed passwords, enhanced security, and offered credit monitoring. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 2, 2022 → Notified Dec 5, 202264d ✗ CA 60-day late10 weeks discovery → filing

Incident timeline

discovery → filing · 10 weeks / 72 days

Oct 2, 2022

Begins

Oct 2, 2022

Discovered

Dec 13, 2022

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Hartnell College
norm: hartnell college
Domain: hartnell.edu

Name: Hartnell College
norm: hartnell college
Domain: hartnell.edu
Industry: Educationllm

Discovered: Oct 2, 2022
Breach occurred: Oct 2, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 5, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the FBINotified applicable state regulators

During the incident: Changed account passwords
Enhanced security protocols
Working with third party specialists to harden our network
Reviewing our policies and procedures related to data protection
Providing 24 months of credit monitoring and identity protection services
Notified the FBI and any applicable state regulators
Changes made: Implementing additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: CA 60-day late · 64dLeak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 2, 2022
→ Notified: Dec 5, 2022
64d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 2, 2022 → Notified: Dec 5, 2022	64d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-560017
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 13, 2022
Raw hash: 7f665f90d69d3f6db1e5f7e3444e9ad9f3195f156751a6352065843f4369afc9

Reporting entityHartnell College

Victim entityHartnell College

Incidentdiscovered Oct 2, 2022

Stated responseChanged account passwords

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov