HackingEducationEducationData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Carmel Clay Schools

bd_ba3c4ed795a5ecb2 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 31, 2021

Filed

Sep 20, 2021

To disclose

20 days

Affected · nationwide

15,8172 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Carmel Clay Schools →

Carmel Clay Schools experienced an external system breach (hacking) between February 15 and 24, 2021, discovered on August 31, 2021. The incident compromised the names and Social Security Numbers of 15,817 individuals, including 2 Maine residents. The school provided written notification on September 20, 2021, and offered 12 months of credit monitoring and identity restoration services through Equifax.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 31, 2021 → Filed with AG Sep 20, 202120d ✓ ME AG ≤30d20 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 197 days

discovery → filing · 20 days

Feb 15, 2021

Begins

Aug 31, 2021

Discovered

Sep 20, 2021

Filed

vs. sector median

7 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_164d87a90d880e5b2021-09-20Verified
Montana State AGbd_326882847ef340da2021-09-20Candidate
Idaho State AGbd_9a5ae29e5b38cd4a2021-09-20Verified
Indiana State AGbd_d4c458eccfee6b692021-09-20Verified

Show 1 more filing ↓up to 18d gap

New Hampshire State AGbd_bc3873a53cb99d6c2021-09-02 · +18dVerified

Name: Carmel Clay Schools
norm: carmel clay schools
Industry: Education

Name: Carmel Clay Schools
norm: carmel clay schools
Industry: Education
Industry: Educationllm

Discovered: Aug 31, 2021
Breach occurred: Feb 15, 2021 – Feb 24, 2021
Undetected for: 197 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 20, 2021
Affected individuals: 15,817state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with Maine Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of identity restoration and credit monitoring through Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: ME AG ≤30d · 20d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 31, 2021
→ Filed with AG: Sep 20, 2021
20d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 31, 2021 → Filed with AG: Sep 20, 2021	20d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGSep 2 · first

Massachusetts State AG+18d

Montana State AG+18d

Idaho State AG+18d

Indiana State AG+18d

Maine State AG+18d · this page

Pattern: first filing Sep 2 (NH), last Sep 20 (ME) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1183b54e-f3f3-49f4-94aa-f9354a77382c.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2021
Raw hash: 0aadd2544e3658648358dffff9a9317cedc8ac2242de3ca9e3de32065295083f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCarmel Clay Schools

Victim entityCarmel Clay Schools

Incidentdiscovered Aug 31, 2021

Stated responseSent written notification to affected individuals

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov