DisclosureLens
HackingEducationEducationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountFinancial credentialsMediumContained

Pacific Union College

bd_fa36af0c7990e4fe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 9, 2023

Filed

Nov 8, 2023

To disclose

4 weeks

Affected · nationwide

56,04122 in this filing

Linked

9 filings

Confidence

65%
Full breach record for Pacific Union College →2 incidents on file

Pacific Union College, an educational institution, reported an external system breach that occurred between March 5 and March 19, 2023. The breach was discovered on October 9, 2023, and affected 56,041 individuals. The compromised information included names combined with financial account or credit/debit card numbers and their associated security codes or PINs. The college began notifying affected individuals in writing on November 8, 2023, and offered 12 months of complimentary credit monitoring services to those whose Social Security numbers were impacted.

Leak gap clock⏱ Leak >90d4 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 218 days
discovery → filing · 4 weeks / 30 days

Mar 5, 2023

Begins

Oct 9, 2023

Discovered

Nov 8, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 9 about the same incident.View merged incident
A leak claim by trigona about this victim predates this filing by 162 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Show 3 more filings ↓up to 8d gap

Filing propagation · 8 filings · 8 states

View merged incident ↗
California State AGNov 7 · first
Massachusetts State AGNov 7 · first
Oregon State AGNov 7 · first
Montana State AGNov 7 · first
Maine State AG+1d · this page
Vermont State AG+2d
New Hampshire State AG+6d
Washington State AG+9d

Pattern: first filing Nov 7 (CA), last Nov 16 (WA) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.