HackingCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Mercyhurst
bd_fc765d7f8bdd497b · schema v1 · pii pii-v1
Full breach record for Mercyhurst →Mercyhurst University, an educational institution in Pennsylvania, reported an external system breach (hacking) occurring between January 16, 2022, and May 15, 2022. The incident was discovered on September 16, 2022, affecting a total of 19,537 individuals, including 39 Maine residents. The breach compromised names and personal identifiers combined with financial account or credit/debit card numbers. The university provided written notification and offered 12 months of credit monitoring and identity restoration services through Epiq.
Maine clockDiscovered Sep 16, 2022 → Filed with AG Feb 21, 2023158d ✗ ME AG >90d23 weeks discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed19,537 affectedView incident
A leak claim by lockbit2 about this victim predates this filing by 281 days.View originating leak claim
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c8128009-506d-4d10-9783-cb8cb17d41f2.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 21, 2023
- Raw hash
- 6e4c44ec1a890797e7a020889df3b61ac4154b7a63fed8e6dfd92f89ced5935d
Reporting entity
- Name
- Mercyhurstnorm: mercyhurst
- Domain
- mercyhurst.edu
- Industry
- Education
Victim entity
- Name
- Mercyhurstnorm: mercyhurst
- Domain
- mercyhurst.edu
- Industry
- Education
Incident
- Discovered
- Sep 16, 2022
- Materiality determined
- —
- Notification sent
- Sep 16, 2022
- Affected individuals
- 19,537
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 23 weeks(158 days from discovery to filing)
- Compliance flags
- ME AG >90d · 158dLeak >180d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Sep 16, 2022→ Filed with AG: Feb 21, 2023158d 90 days ME AG >90d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.