MalwareEducationEducationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryEducationHealth (basic)Identity (basic)Government IDPHIHighContained

Lake Washington Institute of Technology

bd_8da5f94773f4bbcd · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 17, 2024

Filed

Aug 27, 2024

To disclose

10 weeks

Affected

8,694state residents only

Linked

3 filings

Confidence

69%

Full breach record for Lake Washington Institute of Technology →

Lake Washington Institute of Technology (LWTech) disclosed a ransomware incident discovered on June 17, 2024, with activity traced back to June 10, 2024. The breach affected 8,694 students and employees in Washington, exposing PII including SSNs, driver's licenses, and PHI. LWTech engaged forensic experts, notified law enforcement (FBI/WSP), and provided 12 months of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d10 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 10 weeks / 71 days

Jun 10, 2024

Begins

Jun 17, 2024

Discovered

Aug 27, 2024

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteransomhousebd_8c985e129f1ce0432024-06-15 · +73dCandidate

Regulatory filings (1) · sorted by filing gap

Pressransomhousebd_f3422734432e0e0d2024-06-17 · +71dCandidate

Name: Lake Washington Institute of Technology
norm: lake washington institute of
Domain: lwtech.edu

Name: Lake Washington Institute of Technology
norm: lake washington institute of
Domain: lwtech.edu
Industry: Educationllm

Discovered: Jun 17, 2024
Breach occurred: Jun 10, 2024
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 27, 2024
Affected individuals: 8,694state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberDate of birthStudent ID numberMilitary ID numberPassport numberMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General's OfficeNotified FBI Cyber Crimes DivisionNotified Washington State Patrol

During the incident: Engaged outside cybersecurity experts to assist in the investigation and remediation
Notified federal and state law enforcement, including the FBI Cyber Crimes Division and the Washington State Patrol
Secured its systems
Issued a formal notice email to 8,694 students and employees
Published notice of the incident to its website
Notified major statewide media
Changes made: Secured the services of Kroll to provide 12 months of identity monitoring for all LWTech students and employees at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: Leak >30dWA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

PressJun 17 · first

Washington State AG+71d · this page

Pattern: first filing Jun 17, last Aug 27 (WA) — a 71-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30356.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2024
Raw hash: a6b125a53d2b3fa7d59cca7ebd602fb27d5eba913565c0004181d24a1c1a7bef

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityLake Washington Institute of Technology

Victim entityLake Washington Institute of Technology

Incidentdiscovered Jun 17, 2024

Stated responseEngaged outside cybersecurity experts to assist in the investigation and remediation

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com