AccidentalEducationEducationMisdeliveryCustomer Data InvolvedGovernment IDPIIMediumResolved

Des Moines Area Community College

bd_bcd3ea3e1e0d4cf2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 1, 2019

Filed

Nov 30, 2020

To disclose

12 months

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for Des Moines Area Community College →

Des Moines Area Community College notified affected individuals that student Social Security numbers, used historically as student IDs, were inadvertently included in digitized meeting minutes posted online between Dec 2019 and May 2020. The college removed the records, investigated with outside counsel, and offered one year of Experian credit monitoring. No identity fraud was reported.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 months / 365 days

Dec 1, 2019

Begins

Dec 1, 2019

Discovered

Nov 30, 2020

Filed

vs. sector median

+44 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_be1bc5dc6245463d2020-11-24 · +6dVerified
New Hampshire State AGbd_4bac39c7faac228e2020-11-09 · +21dVerified
Maine State AGbd_f86301a14f44d52c2020-11-04 · +26dCandidate
Indiana State AGbd_a205eff3b2c429fe2020-10-30 · +31dVerified

Name: Des Moines Area Community College
norm: des moines area community college

Name: Des Moines Area Community College
norm: des moines area community college
Industry: Educationllm

Discovered: Dec 1, 2019
Breach occurred: Dec 1, 2019 – May 8, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection

During the incident: Had the records taken down
Launched an investigation in consultation with outside data privacy professionals
Offering a complimentary one-year membership of Experian IdentityWorks SM Credit 3B
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(365 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGOct 30 · first

Maine State AG+5d

New Hampshire State AG+10d

Massachusetts State AG+25d

Montana State AG+31d · this page

Pattern: first filing Oct 30 (IN), last Nov 30 (MT) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Des-Moines-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2020
Raw hash: a19898ff3bb27fe1d5b924868e4a2eeccb946aad5d762295f16b6ca42f202662

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDes Moines Area Community College

Victim entityDes Moines Area Community College

Incidentdiscovered Dec 1, 2019

Stated responseHad the records taken down

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov