Breach Report: Prescott College notifies 20,000+ of data breach over five months ago

(image source: Prescott College (seekvectorlogo), 2018))

One-sentence summary:

Prescott College notifies 20,000+ of a data breach in October 2022 five months ago.

Who was involved?

Prescott College (Prescott, Arizona), 20,258 individuals (presumably students), and a threat actor.

What was the timeline?

October 26, 2022: Breach started

October 29, 2022: Breach ends

March 9, 2023: Breach is discovered by Prescott College

April 5, 2023: Prescott College begins victim notification

What occurred?

Prescott College was hacked in October 2022, resulting in the potential breach of over 20,000+ individuals’ sensitive data, including: “individual names, dates of birth, social security numbers, driver license or state ID number, financial account information, passport information, username and passwords, and limited medical and health insurance information” (Dawson, 2023; Prescott College, 2023b, p. 1).

Estimated costs:

Associated incident response costs, breach notification costs, “leading cybersecurity professionals”, M-F call center, Transunion 12-month credit monitoring

Involved laws:

Federal: FERPA (potentially)

State: Maine: 10 M.R.S.A. § 1346

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Dawson, B. (2023). Data Breach Notifications. In Privacy, Identity Theft and Data Security Breaches. Office of the Maine Attorney General. Retrieved April 13, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/6f42eabf-d666-46e8-9c34-23589365275a.shtml

Prescott College. (2023a). DB07297-PrescottCollege-letter_second_SSN_Example(31608921.1)_Redacted_31608992v1.pdf. In Data Breach Notifications (31285644.1). Office of the Maine Attorney General. Retrieved April 13, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/6f42eabf-d666-46e8-9c34-23589365275a/e3472cfd-50df-41a6-bcbf-287829a38226/document.html

Prescott College. (2023b). Notice Regarding Data Breach. In Prescott College (31350697.1). Retrieved April 13, 2023, from https://drive.google.com/file/d/1v4W10NIL6iaan6jeJ5BUrt8wSVN2rA7S/view

Prescott College (seekvectorlogo). (2018, January). prescott-college-vector-logo.png. Seekvectorlogo. https://seekvectorlogo.com/wp-content/uploads/2018/01/prescott-college-vector-logo.png

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com