HackingEducationEducationCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)MediumContained

Suffolk University

bd_e29d07e866015d72 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 9, 2022

Filed

May 25, 2023

To disclose

46 weeks

Affected

1,202state residents only

Linked

3 filings

Confidence

66%

Full breach record for Suffolk University →4 incidents on file

Suffolk University disclosed unauthorized access to its network on July 9, 2022. The university contained the threat and engaged external cybersecurity professionals. Following a manual document review completed on April 24, 2023, it was determined that personal information of certain individuals was accessed. The notice specifically identifies 1,202 Rhode Island residents as impacted. The university is offering one year of complimentary credit monitoring via Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 46 weeks / 320 days

Jul 9, 2022

Begins

Jul 9, 2022

Discovered

May 25, 2023

Filed

vs. sector median

+39 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_b9eb6041e82dc2632023-05-25Candidate
New Hampshire State AGbd_85ca6772d4a3a8cc2023-05-31 · +6dVerified

Name: Suffolk University
norm: suffolk university

Name: Suffolk University
norm: suffolk university
Industry: Educationllm

Discovered: Jul 9, 2022
Breach occurred: Jul 9, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,202state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unknown
Threat actor: External

During the incident: Contained and secured the threat
Commenced a prompt and thorough investigation
Engaged external cybersecurity professionals experienced in handling these types of incidents
Conducted extensive manual document review
Offering a complimentary one-year membership of Experian IdentityWorks Credit 3B
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 46 weeks(320 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGMay 25 · first

California State AGMay 25 · first · this page

New Hampshire State AG+6d

Pattern: first filing May 25 (ME), last May 31 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-567241
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2023
Raw hash: 092aab6f51a93170dac91ac03669a0f5a494e118f9ee87eac400b5706365fd14

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySuffolk University

Victim entitySuffolk University

Incidentdiscovered Jul 9, 2022

Stated responseContained and secured the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov