HackingEducationEducationData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Saint Xavier High School

bd_8e170c5d0a79b390 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 29, 2020

Filed

Nov 10, 2020

To disclose

12 days

Affected · nationwide

3,8851 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Saint Xavier High School →

Saint Xavier High School, an educational institution located in Louisville, KY, experienced an external system breach (hacking) between February 7, 2020, and May 20, 2020. The incident was discovered on October 29, 2020. The breach compromised the names and Social Security Numbers of 3,885 individuals, including one Maine resident. The school provided written notification to affected individuals on November 10, 2020, and offered two years of credit monitoring and identity theft protection services through CyberScout.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 29, 2020 → Filed with AG Nov 10, 202012d ✓ ME AG ≤30d12 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 265 days

discovery → filing · 12 days

Feb 7, 2020

Begins

Oct 29, 2020

Discovered

Nov 10, 2020

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_b64a75a9649064452020-11-10Verified

Name: Saint Xavier High School
norm: saint xavier high school
Domain: cathedralhs.org
Industry: education

Name: Saint Xavier High School
norm: saint xavier high school
Industry: education
Industry: Educationllm

Discovered: Oct 29, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 265 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 10, 2020
Affected individuals: 3,885state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered two years of credit monitoring and identity theft protection services through CyberScout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: ME AG ≤30d · 12d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 29, 2020
→ Filed with AG: Nov 10, 2020
12d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 29, 2020 → Filed with AG: Nov 10, 2020	12d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGNov 10 · first

Maine State AGNov 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c29cda9d-2002-47e8-9d5e-71d2fab9fbf8.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 10, 2020
Raw hash: 50d16fb966c5e6b70b95daef713989af2b4c535d7b7dff5e729802297183c317

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySaint Xavier High School

Victim entitySaint Xavier High School

Incidentdiscovered Oct 29, 2020

Stated responseSent written notification to affected individuals

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov