MalwareEducationEducationRansomwareData EncryptedTargetedEducationIdentity (basic)Government IDPHIHealth (basic)HighContained

DigiPen Institute of Technology

bd_df0fc57f279a42fa · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 21, 2022

Filed

Jul 26, 2022

To disclose

14 weeks

Affected

5,164state residents only

Linked

6 filings

Confidence

71%

Full breach record for DigiPen Institute of Technology →2 incidents on file

DigiPen Institute of Technology reported a ransomware incident affecting 5,164 Washington residents. Unauthorized access occurred between April 21 and May 1, 2022. Data accessed included names, addresses, driver's license numbers, and SSNs. DigiPen engaged cybersecurity experts, notified the FBI, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d14 weeks discovery → filing

Incident timeline

discovery → filing · 14 weeks / 96 days

Apr 21, 2022

Begins

Apr 21, 2022

Discovered

Jul 26, 2022

Filed

vs. sector median

+5 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_205f854c90309ba32022-07-26Verified
Indiana State AGbd_776b988d032346ec2022-07-26Verified
Massachusetts State AGbd_e53ce57e4c6f04242022-07-26Verified
Maine State AGbd_eaacf141213b117b2022-07-26Candidate

Show 1 more filing ↓up to 7d gap

Maine State AGbd_6216d9c75317347b2022-07-19 · +7dCandidate

Name: DigiPen Institute of Technology
norm: digipen institute of
Domain: digipen.edu

Name: DigiPen Institute of Technology
norm: digipen institute of
Domain: digipen.edu
Industry: Educationllm

Discovered: Apr 21, 2022
Breach occurred: Apr 21, 2022 – May 1, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 26, 2022
Affected individuals: 5,164state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDriver's licence numberDate of birthStudent ID numberHealth insurance ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified the Department of Education

During the incident: Secured its digital environment
Engaged leading cybersecurity experts to address the incident, restore operations, and conduct an investigation
Notified the FBI and Department of Education about the incident
Changes made: Working with leading cybersecurity experts to enhance the security of its systems and data
Implementing additional technical security measures
Offering complimentary credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Maine State AGJul 19 · first

Montana State AG+7d

Indiana State AG+7d

Massachusetts State AG+7d

Maine State AG+7d

Washington State AG+7d · this page

Pattern: first filing Jul 19 (ME), last Jul 26 (WA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12975.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2022
Raw hash: 19ac7528ea6270c6d20ec5536d843fde2f370c11bb5143ec91e9e6c0728e0251

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityDigiPen Institute of Technology

Victim entityDigiPen Institute of Technology

Incidentdiscovered Apr 21, 2022

Stated responseSecured its digital environment

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com