HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Oregon State University

bd_01987a303086eae7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 10, 2019

Filed

Jul 25, 2019

To disclose

11 weeks

Affected

1state residents only

Linked

4 filings

Confidence

67%

Full breach record for Oregon State University →

Oregon State University notified the NH AG of unauthorized access to an employee email account discovered May 10, 2019. The access exposed names, addresses, phone numbers, and SSNs of individuals stored in the account. One NH resident was affected. OSU reset credentials, launched an investigation, and offered 1 year of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 11 weeks / 76 days

May 10, 2019

Discovered

Jul 25, 2019

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_9305ca61340eaf772019-07-19 · +6dCandidate
Massachusetts State AGbd_ab4ae1bce45e68832019-07-19 · +6dVerified
Montana State AGbd_afa23b9e1a8ae6ca2019-07-19 · +6dVerified

Name: Oregon State University
norm: oregon state university

Name: Oregon State University
norm: oregon state university
Industry: Educationllm

Discovered: May 10, 2019
Materiality determined: —
Notification sent: Jun 19, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notice to New Hampshire Attorney Generalproviding notice to other state regulators, as required
Initial access: valid_credentials

During the incident: OSU immediately changed the user's credentials
Launched an investigation to determine the nature and scope of the event
Provided preliminary notice to potentially affected individuals via email
Began mailing written notice of this incident to the individuals
Offering individuals potentially impacted by this event with access to one year of complimentary credit monitoring and identity restoration services through Kroll
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Offering individuals potentially impacted by this event with access to one year of complimentary credit monitoring and identity restoration services through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Oregon State AGJul 19 · first

Massachusetts State AGJul 19 · first

Montana State AGJul 19 · first

New Hampshire State AG+6d · this page

Pattern: first filing Jul 19 (OR), last Jul 25 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/oregon-state-20190725.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 25, 2019
Raw hash: a99556233ba25b3ea40f7b7df71dfa24574c12765ae3d0403c5e54649ef3b435

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityOregon State University

Victim entityOregon State University

Incidentdiscovered May 10, 2019

Stated responseOSU immediately changed the user's credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov