HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Varsity Tutors LLC

bd_e423db69abbd12bb · schema v1 · pii pii-v1

Severity

High

Discovered

May 11, 2022

Filed

Jun 3, 2022

To disclose

23 days

Affected · nationwide

24,42119 in this filing

Linked

8 filings

Confidence

66%

Full breach record for Varsity Tutors LLC →

Varsity Tutors LLC reported a breach occurring between Nov 1-6, 2021, discovered on May 11, 2022. Approximately 24,421 individuals were affected, including 19 Maine residents. The incident involved unauthorized access resulting in the acquisition of names and driver's license numbers. Varsity Tutors notified consumers on June 3, 2022, and provided 12 months of credit monitoring and identity restoration services via Equifax.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 11, 2022 → Filed with AG Jun 3, 202223d ✓ ME AG ≤30d23 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 191 days

discovery → filing · 23 days

Nov 1, 2021

Begins

May 11, 2022

Discovered

Jun 3, 2022

Filed

vs. sector median

8 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_13a8de957b4ea2e52022-06-03Candidate
Washington State AGbd_3974dd33e60b4d4b2022-06-03Verified
Montana State AGbd_601e2d05841b7b9e2022-06-03Verified
Oregon State AGbd_81d4e565c2e253ea2022-06-03Verified by operator

Show 3 more filings ↓up to 6d gap

Indiana State AGbd_98523dfca32ae99f2022-06-03Verified
Massachusetts State AGbd_b6cb41de187857522022-06-03Verified
New Hampshire State AGbd_a0f3c40b2dac35b82022-06-09 · +6dVerified

Name: Varsity Tutors LLC
norm: varsity tutors
Domain: varsitytutors.com

Name: Varsity Tutors LLC
norm: varsity tutors
Domain: varsitytutors.com
Industry: Technologyllm

Discovered: May 11, 2022
Breach occurred: Nov 1, 2021 – Nov 6, 2021
Undetected for: 191 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 3, 2022
Affected individuals: 24,421state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Driver's licence number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: valid_credentials

During the incident: Sent written notification to affected consumers
Offered 12 months of credit monitoring and identity restoration services through Equifax
Changes made: Offered 12 months of credit monitoring and identity restoration services through Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: ME AG ≤30d · 23d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 11, 2022
→ Filed with AG: Jun 3, 2022
23d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 11, 2022 → Filed with AG: Jun 3, 2022	23d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGJun 3 · first

Washington State AGJun 3 · first

Montana State AGJun 3 · first

Oregon State AGJun 3 · first

Indiana State AGJun 3 · first

Massachusetts State AGJun 3 · first

Maine State AGJun 3 · first · this page

New Hampshire State AG+6d

Pattern: first filing Jun 3 (CA), last Jun 9 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0020a474-5fec-4672-9ea9-5d3f00b04e9b.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2022
Raw hash: 444a80e0fef2d17d7456264112839d231cbe98d57ba4db76ee64dccdd56ba4e7

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityVarsity Tutors LLC

Victim entityVarsity Tutors LLC

Incidentdiscovered May 11, 2022

Stated responseSent written notification to affected consumers

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov