HackingEducationEducationVulnerability ExploitCustomer Data InvolvedIdentity (basic)CredentialsFinancial accountLowContained

Manhattan Prep

bd_a5faa02d114a6a68 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 25, 2012

Filed

Apr 3, 2012

To disclose

9 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Manhattan Prep →

Manhattan Prep notified customers of a security breach on March 25, 2012, where an unauthorized third party temporarily penetrated their system. The breach exposed personal information including names, addresses, emails, birth dates, usernames, passwords, phone numbers, and credit card details. Manhattan Prep engaged data security experts and law enforcement, removed stored credit card data, and reset passwords. They are reviewing security procedures and modifying technical infrastructure.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 days

Mar 25, 2012

Begins

Mar 25, 2012

Discovered

Apr 3, 2012

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_ad7992336e548cfb2012-04-04 · +1dVerified

Name: Manhattan Prep
norm: manhattan prep
Domain: manhattangmat.com

Name: Manhattan Prep
norm: manhattan prep
Domain: manhattangmat.com
Industry: Educationllm

Discovered: Mar 25, 2012
Breach occurred: Mar 25, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 23, 2012
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Working with law enforcement

During the incident: Conducting a thorough investigation of the breach with the help of data security experts
Working with law enforcement as part of this investigation
Alerted credit card companies that account information was temporarily exposed
Permanently removed all credit card information previously associated with customer accounts from the database
Reset account passwords on the site
Changes made: Reviewing all data security procedures and practices regarding customers' personal information
Modifying technical infrastructure to increase security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGApr 3 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-22876
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 3, 2012
Raw hash: 3df4841a24126e952d5f82bdd04f32a055a3429d698a3b96ca14bd3afdf4dd09

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityManhattan Prep

Victim entityManhattan Prep

Incidentdiscovered Mar 25, 2012

Stated responseConducting a thorough investigation of the breach with the help of data security experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov