HackingEducationEducationCustomer Data InvolvedIdentity (basic)EducationLowContained

Roosevelt University

bd_ad1f887d97d0a8dd · schema v1 · pii pii-v1

Severity

Low

Discovered

May 1, 2023

Filed

Jun 28, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

64%

Full breach record for Roosevelt University →

Roosevelt University notified the California Attorney General of an incident where an unknown actor gained unauthorized access to its network on May 1, 2023. The investigation determined that information related to Free Application for Federal Student Aid (FAFSA) forms, including names and potentially other personal details, may have been accessed. The university engaged third-party specialists, secured its network, and is offering credit monitoring to affected individuals. No misuse of data was observed.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 1, 2023 → Notified Jun 28, 202358d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 58 days

May 1, 2023

Begins

May 1, 2023

Discovered

Jun 28, 2023

Filed

vs. sector median

on median

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Indiana State AGbd_400dc4b062e987a82023-06-28Verified
Massachusetts State AGbd_569ee0835a9123982023-06-28Verified
Maine State AGbd_70ccbe304f57d6b92023-06-28Verified
Vermont State AGbd_72d4adf932a033c42023-06-28Verified

Show 3 more filings ↓up to 178d gap

Montana State AGbd_83056ca295f6efd42023-06-28Verified
New Hampshire State AGbd_f7d0f492565fca302023-07-03 · +5dVerified
Illinois State AGbd_ee860e80f2d81c012023-01-01 · +178dCandidate

Name: Roosevelt University
norm: roosevelt university

Name: Roosevelt University
norm: roosevelt university
Industry: Educationllm

Discovered: May 1, 2023
Breach occurred: May 1, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 28, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Education
Attack vector: Unknown
Threat actor: External
Regulator citations: Reported this incident to law enforcementReporting to regulatory authorities, as required

During the incident: Took steps to secure our network and minimize any disruption to our operations
Launched an investigation into the nature and scope of the incident with the assistance of third-party specialists
Reviewed existing security policies and implemented additional cybersecurity measures
Reported this incident to law enforcement and are cooperating with their investigation
Notifying potentially impacted individuals
Reporting to regulatory authorities, as required
Offering access to credit monitoring and identity theft protection services for 12/24 months at no cost
Changes made: Reviewed existing security policies
Implemented additional cybersecurity measures to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: CA 60-day OK · 58d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 1, 2023
→ Notified: Jun 28, 2023
58d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 1, 2023 → Notified: Jun 28, 2023	58d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+178d

Massachusetts State AG+178d

Maine State AG+178d

Vermont State AG+178d

Montana State AG+178d

California State AG+178d · this page

New Hampshire State AG+183d

Pattern: first filing Jan 1 (IL), last Jul 3 (NH) — a 183-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-568605
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 28, 2023
Raw hash: 9bc3afc01f34bdf79feac6a176ebc633c50276b37dee448027ccacf1f966c01b

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityRoosevelt University

Victim entityRoosevelt University

Incidentdiscovered May 1, 2023

Stated responseTook steps to secure our network and minimize any disruption to our operations

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov