AccidentalEducationEducationMisconfigurationCustomer Data InvolvedGovernment IDIdentity (basic)MediumResolved

Professional Education Institute

bd_b182e03ace851ef9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 3, 2007

Filed

Feb 15, 2007

To disclose

6 weeks

Affected

2state residents only

Confidence

67%

Full breach record for Professional Education Institute →

Professional Education Institute notified the NH Attorney General of a data encryption lapse on its Millionaire Elite website discovered on January 3, 2007. The lapse caused Social Security numbers and dates of birth of a small group of customers, including two New Hampshire residents, to be unencrypted for a short period. The company stated it was not aware of any actual compromise of the data. Customers were notified on February 15, 2007, required to reset passwords, and offered one year of credit monitoring. The company implemented monthly website audits as a remediation measure.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 43 days

Jan 3, 2007

Discovered

Feb 15, 2007

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Professional Education Institute
norm: professional education institute
Domain: millionaireelite.com

Name: Professional Education Institute
norm: professional education institute
Domain: millionaireelite.com
Industry: Educationllm

Discovered: Jan 3, 2007
Materiality determined: —
Notification sent: Feb 15, 2007
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Misconfiguration
Regulator citations: Alerted the appropriate regulatory agency in your state

During the incident: Notified customers in writing regarding the situation
Requiring all customers to create new passwords before they can re-gain access to the Millionaire Elite Web site
Arranged for a full year’s access to Experian’s Triple Alert Credit Monitoring
Changes made: Conducting a comprehensive monthly audit for all of our websites
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/professional-education-20070215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 15, 2007
Raw hash: f65ae737f70ddd86dbed5c51f20d0b8db2ad9184d49318e90a3efb2ba99fd6a9

Reporting entityProfessional Education Institute

Victim entityProfessional Education Institute

Incidentdiscovered Jan 3, 2007

Stated responseNotified customers in writing regarding the situation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov