HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
TST BOCES
bd_9c96f50bb988e2a6 · schema v1 · pii pii-v1
Full breach record for TST BOCES →TST BOCES, an education entity based in New York, experienced an external system breach (hacking) on April 2, 2023, discovered on April 26, 2023. The incident affected 11,088 individuals, including 7 Maine residents. Personal names and financial account numbers (or credit/debit card numbers with security codes/PINs) were compromised. The entity provided written notification on June 9, 2023, and offered one year of credit monitoring and identity theft protection services through TransUnion.
Maine clockDiscovered Apr 26, 2023 → Filed with AG Jun 9, 202344d ⏱ ME AG >30d6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_99e7bdebaef18e4dVermont State AGfiled 2023-06-09Verified
- bd_fd4aae4bea631ff4Montana State AGfiled 2023-06-09Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1cc7647f-2f80-438d-8997-f971726b6cb9.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 9, 2023
- Raw hash
- 9d951c72580649d1aba813ab468b2c82e1ce99fd0482c6ec162a0e953b6ddeb7
Reporting entity
- Name
- TST BOCESnorm: tst boces
Victim entity
- Name
- TST BOCESnorm: tst boces
Incident
- Discovered
- Apr 26, 2023
- Materiality determined
- —
- Notification sent
- Jun 9, 2023
- Affected individuals
- 11,088
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(44 days from discovery to filing)
- Compliance flags
- ME AG >30d · 44d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Apr 26, 2023→ Filed with AG: Jun 9, 202344d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.