DisclosureLens
HackingEducationEducationCustomer Data InvolvedIdentity (basic)Government IDHighContained

Monmouth College

bd_f07429db46807c90 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 14, 2022

Filed

Mar 20, 2024

To disclose

15 months

Affected · nationwide

44,73724 in this filing

Linked

9 records

Confidence

50%
Full breach record for Monmouth College →

Monmouth College, an educational institution, reported a data breach affecting 24 Maine residents. The breach, which occurred on December 6, 2022, and was discovered on December 14, 2022, was categorized as an external system breach or hacking incident. The compromised information includes names or other personal identifiers in combination with Driver's License Numbers or Non-Driver Identification Card Numbers. In response, the college offered 12 months of credit monitoring and identity protection services through TransUnion. The affected individuals were notified in writing on two separate dates, January 4, 2023, and March 4, 2024.

Leak gap clock✗ Leak >180d15 months discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 8 days
discovery → filing · 15 months / 462 days

Dec 6, 2022

Begins

Dec 14, 2022

Discovered

Mar 20, 2024

Filed

This filing is one of 9 records about the same incident.View merged incident
A leak claim by vicesociety about this victim was first seen 425 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Show 3 more filings ↓up to 441d gap

Filing propagation · 8 filings · 8 states

View merged incident ↗
Indiana State AGJan 4 · first
Illinois State AG+422d
Vermont State AG+425d
Montana State AG+441d
California State AG+441d
Washington State AG+441d
Maine State AG+441d · this page
Massachusetts State AG+442d

Pattern: first filing Jan 4 (IN), last Mar 21 (MA) — a 442-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.