DisclosureLens
Social EngineeringEducationEducationPhishingCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumResolved

The Spring Hill School

bd_eaa6cac060f80a26 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 22, 2020

Filed

Mar 1, 2021

To disclose

10 weeks

Affected · nationwide

3431 in this filing

Confidence

65%
Full breach record for The Spring Hill School →

The Hill School, an educational institution, reported a phishing incident that compromised the personal information of 343 individuals. The breach occurred over a prolonged period, from October 14, 2019, to October 9, 2020, and was discovered on December 22, 2020. The compromised data included names and driver's license or non-driver identification card numbers. The school notified affected individuals on March 1, 2021, and offered one year of complimentary credit monitoring and identity theft protection services through Kroll.

Maine clockDiscovered Dec 22, 2020 → Filed with AG Mar 1, 202169d ⏱ ME AG >30d10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 435 days
discovery → filing · 10 weeks / 69 days

Oct 14, 2019

Begins

Dec 22, 2020

Discovered

Mar 1, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed343 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.