HackingEducationEducationStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDCredentialsMediumContained

Cabrillo College

bd_043ea643d86f2e18 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 5, 2017

Filed

Oct 5, 2017

To disclose

4 weeks

Affected

6state residents only

Linked

4 filings

Confidence

65%

Full breach record for Cabrillo College →3 incidents on file

Cabrillo Community College notified affected individuals of a security incident discovered on September 5, 2017, where an unauthorized person accessed a server containing student orientation data. The data included names, DOBs, SSNs, emails, usernames, and passwords. The college disabled the server, enhanced security, improved password storage, and provided 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 30 days

Sep 5, 2017

Discovered

Oct 5, 2017

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_2abf103182c6207c2017-10-05Verified
Massachusetts State AGbd_2fe8a55a1d6508fe2017-10-05Verified
New Hampshire State AGbd_7f970ed41175e1652017-10-05Verified

Name: Cabrillo College
norm: cabrillo college

Name: Cabrillo College
norm: cabrillo college
Industry: Educationllm

Discovered: Sep 5, 2017
Materiality determined: —
Notification sent: Sep 29, 2017
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Disabled the server
Began an investigation
Enhanced the security of our system
Transitioned to a more secure password storage system
Arranged to have AllClear ID protect your identity for twelve months at no cost to you
Changes made: Enhanced the security of our system
Transitioned to a more secure password storage system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGOct 5 · first

Massachusetts State AGOct 5 · first

New Hampshire State AGOct 5 · first

Montana State AGOct 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Cabrillo-Community-College.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2017
Raw hash: d1a7e1dd246b79336be0720722a4ed2af8ad73d09d2a71d717b18d9d9ab4ec19

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCabrillo College

Victim entityCabrillo College

Incidentdiscovered Sep 5, 2017

Stated responseDisabled the server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov