HackingEducationEducationData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)LowContained

Lewis & Clark College

bd_c5dfb315143fa4e0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 3, 2023

Filed

Mar 22, 2024

To disclose

13 months

Affected

Not disclosed

Linked

9 filings

Confidence

65%

Full breach record for Lewis & Clark College →4 incidents on file

Lewis and Clark College detected unauthorized access to its network on March 3, 2023. Investigation determined bad actors took data on or about February 28, 2023. On February 24, 2024, the college determined impacted files contained personal information. The college engaged external cybersecurity professionals, secured the network, and is providing complimentary identity theft protection services. No specific data types were listed in the redacted notice, but PII is implied.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 3, 2023 → Notified Mar 22, 2024385d ✗ CA 60-day late13 months discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 13 months / 385 days

Feb 28, 2023

Begins

Mar 3, 2023

Discovered

Mar 22, 2024

Filed

vs. sector median

+46 wks slower

This filing is one of 9 about the same incident.View merged incident

A leak claim by vicesociety about this victim predates this filing by 356 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitevicesocietybd_721b1595af25beec2023-03-31 · +357dVerified by operator

Regulatory filings (7) · sorted by filing gap

Indiana State AGbd_08ba5d52cb14a1ea2024-03-22Verified by operator
Washington State AGbd_3a306c0e772c46272024-03-22Verified
Maine State AGbd_555bae41e4bfd13e2024-03-22Verified by operator
Montana State AGbd_6847154486297be42024-03-22Verified by operator

Show 3 more filings ↓up to 692d gap

Vermont State AGbd_b3440705167749c22024-03-22Verified by operator
Oregon State AGbd_ce3ecb7237048d002024-04-10 · +19dVerified by operator
Idaho State AGbd_2723cd32c9ffeb602026-02-12 · +692dVerified

Name: Lewis & Clark College
norm: lewis clark college
Domain: lclark.edu

Name: Lewis & Clark College
norm: lewis clark college
Domain: lclark.edu
Industry: Educationllm

Discovered: Mar 3, 2023
Breach occurred: Feb 28, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 22, 2024
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Immediately took steps to secure our network
Launched an investigation assisted by external cybersecurity professionals
Conducted an extensive manual review of the data residing on the impacted servers
Strengthened our network and implemented additional security improvements recommended by third-party cyber security experts
Providing complimentary identity theft protection services
Changes made: Strengthened our network and implemented additional security improvements recommended by third-party cyber security experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(385 days from discovery to filing)
Compliance flags: CA 60-day late · 385dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 3, 2023
→ Notified: Mar 22, 2024
385d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 3, 2023 → Notified: Mar 22, 2024	385d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGMar 22 · first

Washington State AGMar 22 · first

Maine State AGMar 22 · first

Montana State AGMar 22 · first

Vermont State AGMar 22 · first

California State AGMar 22 · first · this page

Oregon State AG+19d

Idaho State AG+692d

Pattern: first filing Mar 22 (IN), last Feb 12 (ID) — a 692-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-582901
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 22, 2024
Raw hash: ce11ec6224c026b55d76ce947e4d13a8bb9e8a8d312ff036ba20b0ca83157ad1

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityLewis & Clark College

Victim entityLewis & Clark College

Incidentdiscovered Mar 3, 2023

Stated responseImmediately took steps to secure our network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov