HackingEducationEducationCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumResolved

Archmere Academy

bd_f021f046eac358c4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2020

Filed

Nov 30, 2020

To disclose

9 weeks

Affected · nationwide

1,3763 in this filing

Linked

4 filings

Confidence

50%

Full breach record for Archmere Academy →

Archmere Academy, an educational institution, reported a data breach affecting 3 Maine residents. The breach, which occurred on May 20, 2020, and was discovered on September 29, 2020, involved an external system hack. The compromised information included names and financial account numbers with associated access codes. The academy provided written notification to the affected individuals on October 30, 2020, and November 18, 2020, and offered 24 months of identity theft protection services through CyberScout for those whose Social Security numbers were involved.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 29, 2020 → Filed with AG Nov 30, 202062d ⏱ ME AG >30d9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 132 days

discovery → filing · 9 weeks / 62 days

May 20, 2020

Begins

Sep 29, 2020

Discovered

Nov 30, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_80392379d25e95ad2020-11-03 · +27dVerified
Delaware State AGbd_b77e156a126c169f2020-10-30 · +31dVerified
Maine State AGbd_ccd6f92a4c03539d2020-10-30 · +31dCandidate

Name: Archmere Academy
norm: archmere academy

Name: Archmere Academy
norm: archmere academy
Industry: Educationllm

Discovered: Sep 29, 2020
Breach occurred: May 20, 2020
Undetected for: 132 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 30, 2020
Affected individuals: 1,376state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: Financial account number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: Offered 24 months of identity theft protection services through CyberScout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: ME AG >30d · 62d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 29, 2020
→ Filed with AG: Nov 30, 2020
62d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 29, 2020 → Filed with AG: Nov 30, 2020	62d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Delaware State AGOct 30 · first

Maine State AGOct 30 · first

Massachusetts State AG+4d

Maine State AG+31d · this page

Pattern: first filing Oct 30 (DE), last Nov 30 (ME) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8558fcd3-46f6-4010-b3d4-edca3a8fcd27.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2020
Raw hash: c4734b360cc709a9d09952ff17f02edca01acae0e7752961672a0089a2ff654a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityArchmere Academy

Victim entityArchmere Academy

Incidentdiscovered Sep 29, 2020

Stated responseOffered 24 months of identity theft protection services through CyberScout

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov