MalwareRansomwareStolen CredentialsData ExfiltratedCustomer Data InvolvedRansom DemandedPHIHEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTCREDENTIALSMediumContained

YALE UNIVERSITY

bd_01c31b85111e2273 · schema v1 · pii pii-v1

Full breach record for YALE UNIVERSITY →

Yale University reported a ransomware incident affecting at least one New Hampshire resident. Unauthorized access occurred around August 11, 2022, detected September 12, 2022. Patient data from Connecticut Plastic Surgery Group (2009-2021) was encrypted, including PHI, SSNs, and credit card numbers. Yale notified the NH AG on Nov 11, 2022, and offered 24 months of credit monitoring.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

bd_06a174c8c22a8203HHS OCRfiled 2022-11-11(3d gap)Candidate

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/yale-university-20221114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2022
Raw hash: b783371d2e875d078a4894d67171985e2684adeca203ecdba59f9b81e3368ffe

Reporting entity

Name: YALE UNIVERSITY
norm: yale university
Domain: yale.edu

Victim entity

Name: YALE UNIVERSITY
norm: yale university
Domain: yale.edu

Incident

Discovered: Sep 12, 2022
Materiality determined: —
Notification sent: Nov 11, 2022
Affected individuals: 1
Data types: PHIHEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTCREDENTIALS
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General John Formella
Initial access: valid_credentials

Compliance

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.