HackingEducationEducationCapture Stored DataData ExfiltratedDelayed DiscoveryCustomer Data InvolvedPIIIdentity (basic)Government IDMediumResolved

Cornish College of the Arts

bd_7fb26e03c9c07018 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 6, 2022

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

70%

Full breach record for Cornish College of the Arts →

Cornish College of the Arts detected unauthorized access to its network. An investigation determined that unauthorized individual(s) potentially removed files and folders from the network between June 6–10, 2021. Affected data included full names and SSNs. The data review concluded April 4, 2022. Affected individuals were offered 12 months of complimentary Experian IdentityWorks Credit 3B monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 6, 2021

Begins

May 6, 2022

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Washington State AGbd_020708122f53f3932022-05-06Verified
Massachusetts State AGbd_a824b886bc07c90b2022-05-06Verified
Maine State AGbd_fb30b45e0dc7f9612022-05-06Verified
New Hampshire State AGbd_9b3f4f6dd05898532022-05-12 · +6dVerified

Show 3 more filings ↓up to 365d gap

Oregon State AGbd_e2d9c81ab16bf4c92022-05-23 · +17dVerified
Indiana State AGbd_15698c296d0dfd722021-05-06 · +365dVerified
Montana State AGbd_74673effc56edb912021-05-06 · +365dCandidate

Name: Cornish College of the Arts
norm: cornish college of the arts

Name: Cornish College of the Arts
norm: cornish college of the arts
Industry: Educationllm

Discovered: —
Breach occurred: Jun 6, 2021 – Jun 10, 2021
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: External

During the incident: Contained and secured the threat
Immediately launched an investigation in consultation with outside cybersecurity professionals
Offering a complimentary one-year membership of Experian IdentityWorks Credit 3B
Set up a dedicated and confidential toll-free response line staffed with professionals familiar with this incident
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGMay 6 · first

Montana State AGMay 6 · first

Washington State AG+365d

Massachusetts State AG+365d

Maine State AG+365d

California State AG+365d · this page

New Hampshire State AG+371d

Oregon State AG+382d

Pattern: first filing May 6 (IN), last May 23 (OR) — a 382-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-553185
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 6, 2022
Raw hash: fe84bc66c8ad6ab240580384894441f7101c1a3f2488fd65665bc65a08a9b992

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityCornish College of the Arts

Victim entityCornish College of the Arts

IncidentUnauthorized Access

Stated responseContained and secured the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov