HackingEducationEducationStolen CredentialsData ExfiltratedGovernment IDPIIMediumContained

Our Lady of the Lake University

bd_fd338da8a640ecfc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 30, 2022

Filed

Mar 30, 2023

To disclose

30 weeks

Affected

5state residents only

Linked

6 filings

Confidence

66%

Full breach record for Our Lady of the Lake University →

Our Lady of the Lake University notified Montana residents of unauthorized network access occurring on or around August 30, 2022. The incident compromised full names and Social Security Numbers. The university engaged outside cybersecurity professionals for investigation and provided 12 months of complimentary credit monitoring and fraud assistance to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 30 weeks / 212 days

Aug 30, 2022

Begins

Aug 30, 2022

Discovered

Mar 30, 2023

Filed

vs. sector median

+22 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteavoslockerbd_b5e9475384f2db0a2022-12-26 · +94dVerified by operator

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_1c065fda0494c21a2023-03-31 · +1dVerified by operator
Indiana State AGbd_3760627b585d000d2023-03-31 · +1dVerified
Maine State AGbd_1dd46276fadaf1692023-04-10 · +11dVerified by operator
Massachusetts State AGbd_9292a9dc110a25a12023-04-10 · +11dVerified by operator

Name: Our Lady of the Lake University
norm: our lady of the lake university

Name: Our Lady of the Lake University
norm: our lady of the lake university
Industry: Educationllm

Discovered: Aug 30, 2022
Breach occurred: Aug 30, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 5state-resident count only
Data types: Government IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Scoreservices at no charge
Providing you with proactive fraud assistance
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(212 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMar 30 · first · this page

Vermont State AG+1d

Indiana State AG+1d

Maine State AG+11d

Massachusetts State AG+11d

Pattern: first filing Mar 30 (MT), last Apr 10 (MA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-179.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 30, 2023
Raw hash: 0012c9d41fb80e0b5fa439a63ea2c2692bcf35b86a227c4f0403e73485b02e44

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityOur Lady of the Lake University

Victim entityOur Lady of the Lake University

Incidentdiscovered Aug 30, 2022

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov