AccidentalEducationEducationMisconfigurationPrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)EducationFinancial accountLowResolved

Anne Arundel Community College

bd_8a6014521905bbdb · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 14, 2025

Filed

Feb 19, 2025

To disclose

5 days

Affected

Not disclosed

Confidence

66%

Full breach record for Anne Arundel Community College →

Anne Arundel Community College reported that an administrative error in its Lifelong Learning Extended Education (LLEE) system allowed one student to view another student's profile. The incident occurred on February 14, 2025, when an admin cross-connected accounts during a deduplication task. Affected data included full name, home address, AACC ID, course history, and the last four digits of credit card numbers. SSN and full credit card numbers were not involved. The college corrected the issue, modified administrative procedures, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Maryland clock✓ MD AG ≤30d5 days discovery → filing

Incident timeline

discovery → filing · 5 days

Feb 14, 2025

Discovered

Feb 19, 2025

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Anne Arundel Community College
norm: anne arundel community college
Domain: aacc.edu

Name: Anne Arundel Community College
norm: anne arundel community college
Domain: aacc.edu
Industry: Educationllm

Discovered: Feb 14, 2025
Materiality determined: —
Notification sent: Feb 20, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)EducationFinancial account
Attack vector: Unknown
Threat actor: Internal
Regulator citations: Notified the Department of EducationNotified the Maryland Office of Attorney General
Initial access: insider_action

During the incident: Immediately corrected the issue
Modified the LLEE administrative procedures to stop this incident from happening again
Notified the Department of Education
Notified the Maryland Office of Attorney General
Offering to reimburse for one year of credit and personal identification monitoring services
Changes made: Modified the LLEE administrative procedures to stop this incident from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 days(5 days from discovery to filing)
Compliance flags: MD AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376375.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2025
Raw hash: fa1939af794d3d2c361ea3851595ee91ada802406cc6a8b336a9348f061e30c7

Reporting entityAnne Arundel Community College

Victim entityAnne Arundel Community College

Incidentdiscovered Feb 14, 2025

Stated responseImmediately corrected the issue

ComplianceMD AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov