HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedGovernment IDFinancial accountPHIHealth (basic)CredentialsHighContained

Paul Quinn College

bd_85f80ebb40f44b7b · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 16, 2019

Filed

Jun 1, 2020

To disclose

41 weeks

Affected

1,159state residents only

Linked

5 filings

Confidence

66%

Full breach record for Paul Quinn College →2 incidents on file

Paul Quinn College experienced unauthorized access to employee email accounts. The incident was discovered on August 16, 2019, with the breach window occurring between May 24, 2019, and August 28, 2020. Personal information including SSNs, driver's licenses, financial account data, and medical information was potentially exposed. 1,159 California residents were notified on June 1, 2020. The college secured accounts, engaged forensic experts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 16, 2019 → Notified Jun 1, 2020290d ✗ CA 60-day late41 weeks discovery → filing

Incident timeline

undetected · 84 days

discovery → filing · 41 weeks / 290 days

May 24, 2019

Begins

Aug 16, 2019

Discovered

Jun 1, 2020

Filed

vs. sector median

+33 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_10704756ad9e095c2020-06-01Verified
Montana State AGbd_38a0f94f5617a9902020-06-01Candidate
Massachusetts State AGbd_2a7f041578d4ff492020-06-02 · +1dVerified
New Hampshire State AGbd_932e81ad804f6a322020-06-02 · +1dVerified

Name: Paul Quinn College
norm: paul quinn college

Name: Paul Quinn College
norm: paul quinn college
Industry: Educationllm

Discovered: Aug 16, 2019
Breach occurred: May 24, 2019 – Aug 28, 2020
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 1, 2020
Affected individuals: 1,159state-resident count only
Data types: Government IDFinancial accountPHIHealth (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified California Attorney General
Initial access: valid_credentials

During the incident: Took steps to secure the impacted email accounts
Further secured our email system
Began an extensive and detailed analysis of the email accounts
Engaged independent cybersecurity experts
Engaged ID Experts to provide complimentary MyIDCare services
Changes made: Further strengthen the security of its email system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(290 days from discovery to filing)
Compliance flags: CA 60-day late · 290d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 16, 2019
→ Notified: Jun 1, 2020
290d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 16, 2019 → Notified: Jun 1, 2020	290d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 1 · first

Montana State AGJun 1 · first

California State AGJun 1 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190540
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2020
Raw hash: 2604ac9d36a583c074b01212c88ee3baa115bfdf24b658ef83d8768f4b895496

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPaul Quinn College

Victim entityPaul Quinn College

Incidentdiscovered Aug 16, 2019

Stated responseTook steps to secure the impacted email accounts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov