HackingEducationEducationStolen CredentialsTargetedData ExfiltratedIdentity (basic)Government IDMediumContained

College Solutions

bd_85709de520a67a56 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 9, 2021

Filed

Nov 29, 2021

To disclose

16 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for College Solutions →

College Solutions notified the NH AG of unauthorized access to employee email accounts between July 28 and August 9, 2021. Discovered August 9, 2021. One NH resident affected. Data included names, addresses, and SSNs. Remediation included credit monitoring and enhanced training.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 12 days

discovery → filing · 16 weeks / 112 days

Jul 28, 2021

Begins

Aug 9, 2021

Discovered

Nov 29, 2021

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_7db38609ec82110c2021-11-23 · +6dVerified
Maine State AGbd_c944cdbcd1916dbd2021-11-23 · +6dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: College Solutions
norm: college solutions
Industry: Educationllm

Discovered: Aug 9, 2021
Breach occurred: Jul 28, 2021 – Aug 9, 2021
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 23, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Initiated an investigation
Undertook a diligent and comprehensive review of the entire contents of the impacted email accounts
Provided written notice of this incident to all affected individuals
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for one (1) year, through Equifax
Commenced an investigation with the assistance of third-party cyber security specialists
Policies and procedures are being reviewed and enhanced where possible
Additional safeguards are being implemented
Workforce training is being conducted
Changes made: Implement additional safeguards and training to its employees
Policies and procedures are being reviewed and enhanced where possible
Additional safeguards are being implemented
Workforce training is being conducted
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 23 · first

Maine State AGNov 23 · first

New Hampshire State AG+6d · this page

Pattern: first filing Nov 23 (MA), last Nov 29 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/college-solutions-20211129.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 29, 2021
Raw hash: 444752f8e12976a05701284017c6944ce074d8ec91f47396a9f2cae25a1ac895

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityCollege Solutions

Incidentdiscovered Aug 9, 2021

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov