HackingEducationEducationData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIGovernment IDHighContained

Suffolk University

bd_7e160369cc05cb91 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Nov 30, 2022

To disclose

—

Affected

1,208scope not determined

Linked

6 filings

Confidence

78%

Full breach record for Suffolk University →4 incidents on file

Suffolk University discovered unauthorized access to its network on or about July 9, 2022. An investigation concluded that certain documents and records were accessed and/or obtained. The data review determined on November 14, 2022 that personal information (including SSNs based on the notice title) was present. 1,208 Rhode Island residents were impacted. Suffolk engaged external cybersecurity professionals and offered 12-month Experian IdentityWorks Credit 3B monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 9, 2022

Begins

Nov 14, 2022

Scope determined

Nov 30, 2022

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_0a5ef8d86e2fc5be2022-11-30Candidate
Indiana State AGbd_de24172583eb4ca32022-11-30Verified
Maine State AGbd_f9879b39d3e8beca2022-11-30Verified by operator
Massachusetts State AGbd_d8991c1e7213359a2022-12-01 · +1dVerified

Show 1 more filing ↓up to 5d gap

New Hampshire State AGbd_21109bcb644009ac2022-12-05 · +5dVerified

Name: Suffolk University
norm: suffolk university

Name: Suffolk University
norm: suffolk university
Industry: Education
Industry: Educationllm

Discovered: —
Breach occurred: Jul 9, 2022
Materiality determined: Nov 14, 2022
Notification sent: —
Affected individuals: 1,208scope not determined
Data types: PIIGovernment ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated CollectionT1074 Data Staged
Threat actor: External

During the incident: Immediately contained and secured the threat
Commenced a prompt and thorough investigation
Engaged external cybersecurity professionals experienced in handling these types of incidents to determine the extent of any compromise of the information on our network
Conducted extensive manual document review
Offering a complimentary one-year membership of Experian IdentityWorks Credit 3B to affected individuals
Set up a dedicated and confidential toll-free response line to respond to questions
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Took significant measures to protect your information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 30 · first

Indiana State AGNov 30 · first

Maine State AGNov 30 · first

California State AGNov 30 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+5d

Pattern: first filing Nov 30 (MT), last Dec 5 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-559608
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2022
Raw hash: e38c071bde159f190ded6cc65b936bf8d962ab6b353a73cda36c76526b65736e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySuffolk University

Victim entitySuffolk University

IncidentUnauthorized Access

Stated responseImmediately contained and secured the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov