HackingEducationEducationStolen CredentialsCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Syracuse University

bd_05b34336f4bd933f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 14, 2022

Filed

Mar 28, 2022

To disclose

6 weeks

Affected

26state residents only

Linked

5 filings

Confidence

66%

Full breach record for Syracuse University →3 incidents on file

Syracuse University notified the New Hampshire Attorney General of a security incident involving unauthorized access to two disbursement office email accounts between November 11-15, 2021. The breach affected 26 New Hampshire residents, whose names and Social Security numbers were potentially accessed. Syracuse secured the accounts, investigated, and began notifying affected individuals on March 28, 2022, offering one year of credit monitoring through Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 95 days

discovery → filing · 6 weeks / 42 days

Nov 11, 2021

Begins

Feb 14, 2022

Discovered

Mar 28, 2022

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_9d537454055110c52022-03-28Candidate
Maine State AGbd_9e4a1a41cbf3953b2022-03-28Verified
Massachusetts State AGbd_b112c43d62017a1f2022-03-28Verified
Indiana State AGbd_f2f7171c849e0fb72022-03-28Verified

Name: Syracuse University
norm: syracuse university

Name: Syracuse University
norm: syracuse university
Industry: Educationllm

Discovered: Feb 14, 2022
Breach occurred: Nov 11, 2021 – Nov 15, 2021
Undetected for: 95 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 28, 2022
Affected individuals: 26state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email accounts
Launched an investigation
Reviewed the emails and attachments contained in the email accounts
Providing written notice via United States Postal Service mail to the New Hampshire residents
Offering a complimentary one-year membership in credit monitoring and identity theft protection services through Experian
Changes made: Implemented additional security measures to enhance the security of its email environment
Continuing to train its employees concerning data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMar 28 · first

Maine State AGMar 28 · first

Massachusetts State AGMar 28 · first

Indiana State AGMar 28 · first

New Hampshire State AGMar 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/syracuse-20220328.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2022
Raw hash: 8f1c4f1742de7f8e413ae139fa983c69a3f291890f2388eee373dc272e25c9d3

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySyracuse University

Victim entitySyracuse University

Incidentdiscovered Feb 14, 2022

Stated responseSecured the email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov