HackingEducationEducationData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountCriticalContained

SAINT XAVIER UNIVERSITY

bd_e2be20372c5a352e · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jul 21, 2023

Filed

Oct 30, 2024

To disclose

16 months

Affected · nationwide

212,26722 in this filing

Linked

7 records

Confidence

65%

Full breach record for SAINT XAVIER UNIVERSITY →

Saint Xavier University reported an external system breach (hacking) where an unauthorized actor downloaded files between June 29 and July 18, 2023. The university became aware of suspicious activity on July 21, 2023. Affected data included names, Social Security numbers, and financial account information. Approximately 212,267 individuals were affected, including 22 Maine residents. Notifications were sent on October 30, 2024, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d16 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 22 days

discovery → filing · 16 months / 467 days

Jun 29, 2023

Begins

Jul 21, 2023

Discovered

Oct 30, 2024

Filed

This filing is one of 7 records about the same incident.View merged incident

A leak claim by alphv about this victim was first seen 443 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_8ccf5c8f1e8552cd2023-08-14 · +443dVerified

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_84d412a28e7d5f4d2024-10-30Verified
Massachusetts State AGbd_e4a17068e5d629912024-10-31 · +1dVerified
Vermont State AGbd_08673f526f077e6d2024-10-23 · +7dVerified
Illinois State AGbd_688e3c00de9130292024-10-01 · +29dCandidate

Press reports (1)

Pressalphvbd_1cc1cbb51e78bb882023-07-21 · +467dCandidate

Name: SAINT XAVIER UNIVERSITY
norm: saint xavier university
Domain: sxu.edu
Industry: Education

Name: SAINT XAVIER UNIVERSITY
norm: saint xavier university
Domain: sxu.edu
Industry: Education
Industry: Educationllm

Discovered: Jul 21, 2023
Breach occurred: Jun 29, 2023 – Jul 18, 2023
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 30, 2024
Affected individuals: 212,267state + nationwide
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney GeneralNotified federal law enforcement

During the incident: Initiated a comprehensive investigation with the assistance of external cybersecurity specialists
Promptly notified federal law enforcement
Provided 12 months of complimentary credit monitoring services through IDX, a ZeroFox company
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Notifying relevant regulatory authorities
Changes made: Review and enhance existing policies and procedures relating to data protection and security
Implement additional technical and administrative safeguards and training to employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(467 days from discovery to filing)
Compliance flags: Leak >180dME AG >30d · 467dME resident >60d · 467d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 21, 2023
→ Filed with AG: Oct 30, 2024
467d 30 days (soft) ME AG >30d
Maine
Discovered: Jul 21, 2023
→ Notified: Oct 30, 2024
467d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 21, 2023 → Filed with AG: Oct 30, 2024	467d	30 days (soft)	ME AG >30d
Maine	Discovered: Jul 21, 2023 → Notified: Oct 30, 2024	467d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGOct 1 · first

Vermont State AG+22d

Indiana State AG+29d

Maine State AG+29d · this page

Massachusetts State AG+30d

Pattern: first filing Oct 1 (IL), last Oct 31 (MA) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f05c84c9-27bc-446c-91e6-6ab25ca1de20.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 30, 2024
Raw hash: 91736112ebaa94046ed472b328bdf4d8059c086cc7caa11e5df79a0bd3d24c1a

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Press reports (1)

Reporting entitySAINT XAVIER UNIVERSITY

Victim entitySAINT XAVIER UNIVERSITY

Incidentdiscovered Jul 21, 2023

Stated responseInitiated a comprehensive investigation with the assistance of external cybersecurity specialists

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov