HackingEducationEducationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

North Yarmouth Academy

bd_bfa1b622989f6a0e · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 22, 2025

Filed

Jul 2, 2025

To disclose

6 weeks

Affected

104state residents only

Confidence

66%

Full breach record for North Yarmouth Academy →

North Yarmouth Academy reported an external system breach (hacking) on April 29, 2025, discovered on May 22, 2025. The incident affected 104 individuals, including names, contact information, and Social Security Numbers. The Academy engaged external security experts, implemented additional safeguards, and offered 12 months of Experian identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 22, 2025 → Filed with AG Jul 2, 202541d ⏱ ME AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 23 days

discovery → filing · 6 weeks / 41 days

Apr 29, 2025

Begins

May 22, 2025

Discovered

Jul 2, 2025

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed104 affectedView incident

Name: North Yarmouth Academy
norm: north yarmouth academy

Name: North Yarmouth Academy
norm: north yarmouth academy
Industry: Educationllm

Discovered: May 22, 2025
Breach occurred: Apr 29, 2025
Undetected for: 23 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 2, 2025
Affected individuals: 104state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed notification with the Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged with external security experts to assist in the investigation
Implemented additional administrative and technical safeguards
Offered 12 months of complimentary Experian Identity Monitoring Services
Changes made: Engaged with external security experts to assist in the investigation
Implemented additional administrative and technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: ME AG >30d · 41d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 22, 2025
→ Filed with AG: Jul 2, 2025
41d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 22, 2025 → Filed with AG: Jul 2, 2025	41d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ffa03334-0876-4bba-9055-a570bb7812e1.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2025
Raw hash: 17138db831f157dccf36ce9d0cb4ba081c44082ccac098a8d0c39108a764d07a

Reporting entityNorth Yarmouth Academy

Victim entityNorth Yarmouth Academy

Incidentdiscovered May 22, 2025

Stated responseEngaged with external security experts to assist in the investigation

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov