HackingEducationEducationCustomer Data InvolvedTargetedGovernment IDIdentity (basic)Health (basic)Financial accountHighContained

St. Lawrence Lewis Board of Cooperative Educational Services

bd_8402622f99506726 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 12, 2024

Filed

Jul 19, 2025

To disclose

49 weeks

Affected · nationwide

10,99312 in this filing

Linked

4 filings

Confidence

66%

Full breach record for St. Lawrence Lewis Board of Cooperative Educational Services →

St. Lawrence Lewis Board of Cooperative Educational Services (an education entity in NY) reported an external system breach (hacking) occurring on July 24, 2024, discovered on August 12, 2024. Approximately 10,993 individuals were affected, including 12 Maine residents. Compromised data included SSNs, names, addresses, DOBs, tax IDs, medical info, and financial account numbers. The entity engaged a cybersecurity firm, notified law enforcement, and offered 12 months of credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 12, 2024 → Filed with AG Jul 19, 2025341d ✗ ME AG >90d49 weeks discovery → filing

Incident timeline

undetected · 19 days

discovery → filing · 49 weeks / 341 days

Jul 24, 2024

Begins

Aug 12, 2024

Discovered

Jul 19, 2025

Filed

vs. sector median

+42 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_6c56867d8191eec92025-07-18 · +1dVerified
Vermont State AGbd_bcc4fc0e23cf170d2025-07-22 · +3dVerified
Indiana State AGbd_63291b62b638d4192025-06-11 · +38dCandidate

Name: St. Lawrence Lewis Board of Cooperative Educational Services
norm: st lawrence lewis board of cooperative educational

Name: St. Lawrence Lewis Board of Cooperative Educational Services
norm: st lawrence lewis board of cooperative educational
Industry: Educationllm

Discovered: Aug 12, 2024
Breach occurred: Jul 24, 2024
Undetected for: 19 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 11, 2025
Affected individuals: 10,993state + nationwide
Data types: Government IDIdentity (basic)Health (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation
Engaged a national cybersecurity firm to assist in assessing the scope of the incident
Took steps to mitigate the potential impact
Notified law enforcement
Changes made: Evaluating opportunities to further secure our systems to prevent a similar event from occurring again in the future
Arranged for complimentary TransUnion credit monitoring, credit report and credit score services
Providing proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 49 weeks(341 days from discovery to filing)
Compliance flags: ME AG >90d · 341dME resident >180d · 303d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 12, 2024
→ Filed with AG: Jul 19, 2025
341d 90 days ME AG >90d
Maine
Discovered: Aug 12, 2024
→ Notified: Jun 11, 2025
303d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 12, 2024 → Filed with AG: Jul 19, 2025	341d	90 days	ME AG >90d
Maine	Discovered: Aug 12, 2024 → Notified: Jun 11, 2025	303d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJun 11 · first

Massachusetts State AG+37d

Maine State AG+38d · this page

Vermont State AG+41d

Pattern: first filing Jun 11 (IN), last Jul 22 (VT) — a 41-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/64a4742c-859e-400b-8098-589299a4052c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 19, 2025
Raw hash: d885dbc8054711acd45771d6b36d5fab2dd828fe4239f961dd05fcae8c7cb357

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySt. Lawrence Lewis Board of Cooperative Educational Services

Victim entitySt. Lawrence Lewis Board of Cooperative Educational Services

Incidentdiscovered Aug 12, 2024

Stated responseLaunched an investigation

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov