HackingEducationEducationVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEducationIdentity (basic)Government IDHighActive

Bellingham Technical College

bd_b74f5835939875b4 · schema v1 · pii pii-v1

Severity

High

Discovered

May 30, 2023

Filed

Jul 28, 2023

To disclose

8 weeks

Affected

1,600state residents only

Confidence

69%

Full breach record for Bellingham Technical College →

Bellingham Technical College notified of third-party breach involving National Student Clearinghouse's MOVEit file transfer software. Incident discovered May 30, 2023. Up to 1,600 Washington residents affected. Data types include names, DOB, SSN, and student IDs. NSC investigation ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

May 30, 2023

Discovered

Jul 28, 2023

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,600 affectedView incident

Name: Bellingham Technical College
norm: bellingham technical college
Domain: btc.edu
Industry: Education

Name: Bellingham Technical College
norm: bellingham technical college
Domain: btc.edu
Industry: Education
Industry: Educationllm

Discovered: May 30, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 1,600state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDate of birthStudent ID number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General’s Office
Third party: via National Student Clearinghouse
Initial access: exploit_public_facing

During the incident: Issued a press release
Set up a webpage to inform the campus community
Conducting its own investigation of the information it shared with NSC
Reviewed internal procedures to ensure data security
Changed passwords
Reviewed data sets shared with NSC
Working closely with the Attorney General’s Office
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26019.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 28, 2023
Raw hash: 3d1c9ece628c8183f2f3f4875a524dcf203d83fd44ff1607bd8ca6de81fd0bf3

Reporting entityBellingham Technical College

Victim entityBellingham Technical College

Incidentdiscovered May 30, 2023

Stated responseIssued a press release

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com