HackingEducationEducationIdentity (basic)Government IDHighContained

Carnegie Mellon University

bd_e5516b04777ac61c · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 4, 2023

Filed

Jan 12, 2024

To disclose

6 weeks

Affected · nationwide

7,34324 in this filing

Linked

6 filings

Confidence

50%

Full breach record for Carnegie Mellon University →

Carnegie Mellon University reported a data breach to the Maine Attorney General, indicating that an external system breach (hacking) occurred on August 24, 2023. The breach was discovered on December 4, 2023, and affected 24 Maine residents. The compromised information includes names and Social Security Numbers. In response, the university is offering two years of identity theft protection and credit monitoring services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 4, 2023 → Filed with AG Jan 12, 202439d ⏱ ME AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 102 days

discovery → filing · 6 weeks / 39 days

Aug 24, 2023

Begins

Dec 4, 2023

Discovered

Jan 12, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_4b400de4cd0922bf2024-01-12Verified
Massachusetts State AGbd_9d2179772cf585962024-01-12Verified
Indiana State AGbd_a73a836d2c2f9a932024-01-12Verified
Vermont State AGbd_d7e9b0ee37521eac2024-01-12Verified

Show 1 more filing ↓

Montana State AGbd_fa71a693bd4077562024-01-12Candidate

Name: Carnegie Mellon University
norm: carnegie mellon university
Industry: Education

Name: Carnegie Mellon University
norm: carnegie mellon university
Industry: Education
Industry: Educationllm

Discovered: Dec 4, 2023
Breach occurred: Aug 24, 2023
Undetected for: 102 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 12, 2024
Affected individuals: 7,343state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: Offered two years of Experian IdentityWorks identity theft protection and credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: ME AG >30d · 39d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 4, 2023
→ Filed with AG: Jan 12, 2024
39d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 4, 2023 → Filed with AG: Jan 12, 2024	39d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

California State AGJan 12 · first

Massachusetts State AGJan 12 · first

Indiana State AGJan 12 · first

Vermont State AGJan 12 · first

Montana State AGJan 12 · first

Maine State AGJan 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a3149073-c145-4b26-ae92-a062ca803d41.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2024
Raw hash: 05d955bb4f9d8e00c0fb216cc6b116e0a191f9ec29734c26a72105897aa820f6

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCarnegie Mellon University

Victim entityCarnegie Mellon University

Incidentdiscovered Dec 4, 2023

Stated responseOffered two years of Experian IdentityWorks identity theft protection and credit monitoring services

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov