MalwareEducationEducationRansomwareData EncryptedCustomer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)EducationMediumContained

R3 Education

bd_ba7f4c07ddee5ab4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 7, 2023

Filed

May 28, 2024

To disclose

29 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for R3 Education →

R3 Education Inc. detected unusual network activity on November 7, 2023, leading to the discovery of unauthorized access and encryption of data by an unknown party. The incident potentially exposed personal information including names, dates of birth, government IDs, medical/health information, and student IDs. R3 disconnected network access, investigated the scope, and is providing credit monitoring services to affected individuals. No evidence of data misuse was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 7, 2023 → Notified Mar 25, 2024139d ✗ CA 60-day late29 weeks discovery → filing

Incident timeline

discovery → filing · 29 weeks / 203 days

Nov 7, 2023

Begins

Nov 7, 2023

Discovered

May 28, 2024

Filed

vs. sector median

+20 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_4a364e06442278782024-05-28Verified
New Hampshire State AGbd_9e69937e0c5308402024-05-28Verified
Maine State AGbd_aa05df0b3364d3e02024-05-28Verified
Montana State AGbd_e1c177816da456d52024-05-24 · +4dCandidate

Show 1 more filing ↓up to 64d gap

Indiana State AGbd_e0a16b5a6841313c2024-03-25 · +64dVerified

Name: R3 Education
norm: r3 education

Name: R3 Education
norm: r3 education
Industry: Educationllm

Discovered: Nov 7, 2023
Breach occurred: Nov 7, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 25, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)Education
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External

During the incident: Disconnected all access to the network
Commenced an investigation to determine the scope of the incident
Made network access changes
Changed administrative credentials
Restored operations in a safe and secure mode
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Taken steps to mitigate the risk of future harm
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(203 days from discovery to filing)
Compliance flags: CA 60-day late · 139d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 7, 2023
→ Notified: Mar 25, 2024
139d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 7, 2023 → Notified: Mar 25, 2024	139d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGMar 25 · first

Montana State AG+60d

Massachusetts State AG+64d

New Hampshire State AG+64d

Maine State AG+64d

California State AG+64d · this page

Pattern: first filing Mar 25 (IN), last May 28 (CA) — a 64-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-586061
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 28, 2024
Raw hash: 064e1aa4770a18b561862a977d63520650080238f528aaf110287afbfe39e04b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityR3 Education

Victim entityR3 Education

Incidentdiscovered Nov 7, 2023

Stated responseDisconnected all access to the network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov