HackingEducationEducationCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

MCPHS University

bd_b6781c9a7791b19e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 27, 2023

Filed

Oct 27, 2023

To disclose

4 weeks

Affected · nationwide

8996 in this filing

Confidence

50%

Full breach record for MCPHS University →

MCPHS University reported an external system breach that occurred between May 29, 2023, and June 5, 2023. The breach was discovered on September 27, 2023. The incident affected 6 Maine residents, compromising their names and Social Security numbers. In response, the university provided 12 months of credit monitoring and identity theft protection services through Kroll.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 27, 2023 → Filed with AG Oct 27, 202330d ✓ ME AG ≤30d4 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 121 days

discovery → filing · 4 weeks / 30 days

May 29, 2023

Begins

Sep 27, 2023

Discovered

Oct 27, 2023

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed899 affectedView incident

Name: MCPHS University
norm: mcphs university

Name: MCPHS University
norm: mcphs university
Industry: Educationllm

Discovered: Sep 27, 2023
Breach occurred: May 29, 2023 – Jun 5, 2023
Undetected for: 121 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 3, 2023
Affected individuals: 899state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: Offered 12 months of credit monitoring and identity theft protection services through Kroll.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: ME AG ≤30d · 30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 27, 2023
→ Filed with AG: Oct 27, 2023
30d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 27, 2023 → Filed with AG: Oct 27, 2023	30d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/3d33d0b8-6844-493b-bd37-be6ec0ccc8e2.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 27, 2023
Raw hash: 9d5fe0ab434ccd97be0a54a3869c6a6d6edc07c23ecd19c0d20385f0ee17bb90

Reporting entityMCPHS University

Victim entityMCPHS University

Incidentdiscovered Sep 27, 2023

Stated responseOffered 12 months of credit monitoring and identity theft protection services through Kroll.

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov