HackingIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Southern Arkansas University Tech

bd_eb4cd5168bb4b2ca · schema v1 · pii pii-v2

Severity

Medium

Discovered

Oct 1, 2024

Filed

Apr 29, 2025

To disclose

—

Affected

7state residents only

Linked

4 filings

Confidence

67%

Full breach record for Southern Arkansas University Tech →

Southern Arkansas University Tech (SAU Tech) notified the Nebraska Attorney General of a data security incident discovered in October 2024. An unauthorized user gained access to SAU Tech's systems and may have copied files containing personal information, including names, SSNs, driver's license numbers, financial data, and limited health information. Seven Nebraska residents were affected. SA Tech engaged cybersecurity specialists, notified law enforcement, reset passwords, deployed endpoint monitoring, and offered 12 months of credit monitoring via IDX. Notification letters were sent on April 29, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 1, 2024

Discovered

Apr 29, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_e16c38f1072214b92025-04-29Verified
Maine State AGbd_8b509c6bf302850f2025-04-30 · +1dCandidate
New Hampshire State AGbd_c4eadb3b0e3a516d2025-05-05 · +6dVerified

Name: CLARK HILL PLC
norm: clark hill

Name: Southern Arkansas University Tech
norm: southern arkansas university tech
Industry: education

Discovered: Oct 1, 2024
Materiality determined: —
Notification sent: Apr 29, 2025
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Nebraska Attorney General
Initial access: valid_credentials

During the incident: Implemented their incident response protocols
Engaged independent cybersecurity specialists
Began an investigation to determine the scope and extent of the incident
Law enforcement was also notified
Worked with a vendor to review the impacted data
Performing a global password resent
Deploying endpoint detection monitoring software on all systems
Implementing additional security controls
Letters were mailed to potentially affected individuals
Enrolling in 12 months of credit monitoring and identity protection services through IDX
Changes made: Performing a global password reset
Deploying endpoint detection monitoring software on all systems
Implementing additional security controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGApr 29 · first

Nebraska State AGApr 29 · first · this page

Maine State AG+1d

New Hampshire State AG+6d

Pattern: first filing Apr 29 (IN), last May 5 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/fd2410da-7044-4dab-93ad-1a5815762536.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2025
Raw hash: 9a336d01da1314b2046a90d81896ffa0be367fd08f49ebf90f7738f5a4ed789c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCLARK HILL PLC

Victim entitySouthern Arkansas University Tech

Incidentdiscovered Oct 1, 2024

Stated responseImplemented their incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov