MisuseEducationEducationPrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Scripps College

bd_a76f6c49f66eb0b9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 30, 2012

Filed

Jul 10, 2012

To disclose

10 days

Affected

11state residents only

Linked

3 filings

Confidence

66%

Full breach record for Scripps College →

Scripps College notified NH AG of unauthorized access to financial aid data of 11 NH residents. A former employee shared applicant info (names, SSNs, DOB, financial data) with an external financial aid professional between 2008 and 2012 to assist with application reviews. The incident was discovered in late June 2012. Access was revoked, and notifications were mailed in July 2012. No evidence of further misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1642 days

discovery → filing · 10 days

Jan 1, 2008

Begins

Jun 30, 2012

Discovered

Jul 10, 2012

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_3cdae602a5d489c72012-07-12 · +2dCandidate
Massachusetts State AGbd_9f4b0802e1aae47a2012-07-16 · +6dVerified

Name: Scripps College
norm: scripps college

Name: Scripps College
norm: scripps college
Industry: Educationllm

Discovered: Jun 30, 2012
Breach occurred: Jan 1, 2008 – Dec 31, 2012
Undetected for: 1,642 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2012
Affected individuals: 11state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: InternalSecondary
Regulator citations: Notified New Hampshire Attorney General
Initial access: insider_action

During the incident: Eliminated the employee’s access to the financial aid information
Acted to prevent further access by the unauthorized individual
Reviewed its computer systems and security
Conducted interviews to assess the scope of the conduct
Sent notices via U.S. First Class Mail to affected individuals
Changes made: Reviewed its access procedures related to financial aid data
Taking steps to further enhance security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGJul 10 · first · this page

California State AG+2d

Massachusetts State AG+6d

Pattern: first filing Jul 10 (NH), last Jul 16 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/scripps-college-20120710.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2012
Raw hash: 6aeb5b3db37999380f18cb479d99222199d930d83f8d10f95e0cb3e67f44e6b7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityScripps College

Victim entityScripps College

Incidentdiscovered Jun 30, 2012

Stated responseEliminated the employee’s access to the financial aid information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov