HackingEducationEducationStolen CredentialsCustomer Data InvolvedIdentity (basic)PIILowContained

Cambridge University Press & Assessment

bd_f3652a3364012f38 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 5, 2024

Filed

Apr 23, 2025

To disclose

46 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

66%

Full breach record for Cambridge University Press & Assessment →

Cambridge University Press & Assessment notified Vermont AG of a June 5, 2024 unauthorized access incident affecting a subsidiary in Australia. Personal information including names and addresses was accessed. The company engaged forensic experts, notified law enforcement, and is offering two years of Experian credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday46 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 46 weeks / 322 days

Jun 5, 2024

Discovered

Apr 23, 2025

Filed

vs. sector median

+36 wks slower

This filing is one of 8 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 322 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteinc_ransombd_376a18b384effbd92024-06-24 · +303dVerified
Leak Siteinc_ransombd_4ca07a68d8bd05d62024-06-05 · +322dVerified

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_443cd1e253127d972025-04-23Verified
Nebraska State AGbd_5f82640da0c387692025-04-23Verified
California State AGbd_6335ccbbbad76b8a2025-04-23Verified
Maine State AGbd_796965d352b1ce942025-04-23Verified

Show 1 more filing ↓

Indiana State AGbd_9286818ff200a9232025-04-23Candidate

Name: Cambridge University Press & Assessment
norm: cambridge university press assessment

Name: Cambridge University Press & Assessment
norm: cambridge university press assessment
Industry: Educationllm

Discovered: Jun 5, 2024
Materiality determined: —
Notification sent: Apr 8, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: informed law enforcement and are supporting their investigation
Initial access: valid_credentials

During the incident: Took immediate action to secure and protect our systems
Appointed external forensic and IT security experts to carry out a full investigation
Informed law enforcement and are supporting their investigation
Offering you two years of credit and identity monitoring services, free of charge, with Experian IdentityWorksSM Credit 3B
Changes made: Taken steps to enhance our existing security controls and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 46 weeks(322 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGApr 23 · first

Nebraska State AGApr 23 · first

California State AGApr 23 · first

Maine State AGApr 23 · first

Indiana State AGApr 23 · first

Vermont State AGApr 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-04-23-cambridge-university-press-assessment-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 23, 2025
Raw hash: 18796e848af8ccc5068f72776119c1b2c7bd876670ebecec9602944c4f01d523

Linked disclosures

Ransomware claims (2)

Regulatory filings (5) · sorted by filing gap

Reporting entityCambridge University Press & Assessment

Victim entityCambridge University Press & Assessment

Incidentdiscovered Jun 5, 2024

Stated responseTook immediate action to secure and protect our systems

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov