DisclosureLens
HackingEducationEducationCustomer Data InvolvedIdentity (basic)Government IDHighContained

Monmouth College

bd_f07429db46807c90 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 14, 2022

Filed

Mar 20, 2024

To disclose

15 months

Affected · nationwide

44,73724 in this filing

Linked

5 filings

Confidence

50%
Full breach record for Monmouth College →3 incidents on file

Monmouth College, an educational institution, reported a data breach affecting 24 Maine residents. The breach, which occurred on December 6, 2022, and was discovered on December 14, 2022, was categorized as an external system breach or hacking incident. The compromised information includes names or other personal identifiers in combination with Driver's License Numbers or Non-Driver Identification Card Numbers. In response, the college offered 12 months of credit monitoring and identity protection services through TransUnion. The affected individuals were notified in writing on two separate dates, January 4, 2023, and March 4, 2024.

Maine clockDiscovered Dec 14, 2022 → Filed with AG Mar 20, 2024462d ✗ ME AG >90d15 months discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 8 days
discovery → filing · 15 months / 462 days

Dec 6, 2022

Begins

Dec 14, 2022

Discovered

Mar 20, 2024

Filed

vs. sector median

+57 wks slower

This filing is one of 5 about the same incident.View merged incident
A leak claim by vicesociety about this victim predates this filing by 424 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Indiana State AGJan 4 · first
California State AG+441d
Washington State AG+441d
Maine State AG+441d · this page

Pattern: first filing Jan 4 (IN), last Mar 20 (ME) — a 441-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.