No intrusion of its own — a dependency with a deadline, hitting the one week in the academic year with no slack in it.
One vendor incident becomes many provider notifications on different dates. Anyone counting breaches sees several small ones.