HackingEducationEducationStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

Pacific Union College

bd_9c39c3895a33ce7e · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 19, 2023

Filed

Nov 16, 2023

To disclose

35 weeks

Affected

1,921state residents only

Linked

9 filings

Confidence

69%

Full breach record for Pacific Union College →2 incidents on file

Pacific Union College notified the Washington AG of unauthorized network access occurring March 5-19, 2023. The incident compromised names, SSNs, driver's licenses, financial account info, and medical data for ~1,921 Washington residents. Notifications were sent November 9, 2023, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d35 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 14 days

discovery → filing · 35 weeks / 242 days

Mar 5, 2023

Begins

Mar 19, 2023

Discovered

Nov 16, 2023

Filed

vs. sector median

+26 wks slower

This filing is one of 9 about the same incident.View merged incident

A leak claim by trigona about this victim predates this filing by 170 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitetrigonabd_6033bd183ac097462023-05-30 · +170dVerified

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_b961a48bdfa4479b2023-11-13 · +3dVerified
Vermont State AGbd_9d1dc3ff1d515b8f2023-11-09 · +7dVerified
Maine State AGbd_fa36af0c7990e4fe2023-11-08 · +8dCandidate
California State AGbd_3d77409f4135c7592023-11-07 · +9dVerified

Show 3 more filings ↓up to 9d gap

Massachusetts State AGbd_76165e2332afc30e2023-11-07 · +9dVerified by operator
Oregon State AGbd_ea10a61c3e970c3a2023-11-07 · +9dCandidate
Montana State AGbd_eb6b267241ca6c382023-11-07 · +9dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Pacific Union College
norm: pacific union college
Domain: puc.edu
Industry: Educationllm

Discovered: Mar 19, 2023
Breach occurred: Mar 5, 2023 – Mar 19, 2023
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 9, 2023
Affected individuals: 1,921state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of Washington Attorney General Consumer Protection Division
Initial access: valid_credentials

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Providing the affected residents with written notification of this incident
Offering the affected residents whose Social Security numbers were impacted complimentary one-year memberships with a credit monitoring service
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(242 days from discovery to filing)
Compliance flags: WA AG >90dLeak >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGNov 7 · first

Massachusetts State AGNov 7 · first

Oregon State AGNov 7 · first

Montana State AGNov 7 · first

Maine State AG+1d

Vermont State AG+2d

New Hampshire State AG+6d

Washington State AG+9d · this page

Pattern: first filing Nov 7 (CA), last Nov 16 (WA) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16337.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 16, 2023
Raw hash: 0016d2ad884dd5fdf8d0ff22f31a29ab494761a2d1d48fbb65f1fcaac28b6bf0

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityPacific Union College

Incidentdiscovered Mar 19, 2023

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com