AccidentalGovernmentEducationGovernmentMisconfigurationTargetedCustomer Data InvolvedPIIIdentity (basic)Government IDHighContained

SC Commission on Higher Education

bd_a2c04401e8662841 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 1, 2018

Filed

Mar 18, 2018

To disclose

6 weeks

Affected

3,200state residents only

Confidence

66%

Full breach record for SC Commission on Higher Education →

South Carolina Commission on Higher Education notified Palmetto Fellows Scholarship recipients that their database was exposed without authorization from May 26, 2017, until discovery in February 2018. Data included names, addresses, and SSNs. No malicious intent or identity theft was found. Forensic investigators and SLED were engaged.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 251 days

discovery → filing · 6 weeks / 45 days

May 26, 2017

Begins

Feb 1, 2018

Discovered

Mar 18, 2018

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,200 affectedView incident

Name: SC Commission on Higher Education
norm: sc commission on higher education
Domain: che.sc.gov

Name: SC Commission on Higher Education
norm: sc commission on higher education
Domain: che.sc.gov
Industry: GovernmentllmEducationllm

Discovered: Feb 1, 2018
Breach occurred: May 26, 2017
Undetected for: 251 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 11, 2018
Affected individuals: 3,200state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Notified the S.C. Department of Consumer AffairsWorked with the State Law Enforcement Division (SLED)

During the incident: Stopped the exposure immediately
Brought in forensic investigators to determine the exact cause and nature of the incident
Work with state and private information technology security experts, including the State Law Enforcement Division (SLED)
Notified law enforcement
Notified the S.C. Department of Consumer Affairs
Notified the national credit rating agencies
Changes made: Continually reviewing and strengthening policies, procedures, and practices to minimize the risk of any unauthorized data exposure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2018/SCComHigherEducation.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2018
Raw hash: f8482bf78ddaf23ac58d3f04596f7d45724deac8faf6d00d77666e70af866674

Reporting entitySC Commission on Higher Education

Victim entitySC Commission on Higher Education

Incidentdiscovered Feb 1, 2018

Stated responseStopped the exposure immediately

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov