AccidentalEducationEducationMisconfigurationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHighActive

Global University

bd_061b412aa28f416b · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 1, 2018

Filed

May 8, 2018

To disclose

14 weeks

Affected

14,660state residents only

Linked

7 filings

Confidence

66%

Full breach record for Global University →

Global University notified the California AG of a data breach affecting 14,660 California residents. A database containing student names and Social Security numbers was misconfigured and accessible to the Internet from December 31, 2017, to January 31, 2018. The university discovered the potential exposure on February 1, 2018. The investigation is ongoing. Affected individuals are offered one year of credit monitoring and identity restoration services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 32 days

discovery → filing · 14 weeks / 96 days

Dec 31, 2017

Begins

Feb 1, 2018

Discovered

May 8, 2018

Filed

vs. sector median

+5 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_77ffa4f9d6798d232018-05-08Verified
Washington State AGbd_9be0fff45ee6f7c32018-05-08Verified
Montana State AGbd_de7058957e71dff32018-05-08Verified
Oregon State AGbd_eaa4fc075adca0972018-05-08Candidate

Show 2 more filings ↓up to 22d gap

South Carolina State AGbd_32a1fdea64af3d402018-05-15 · +7dVerified
Hawaii State AGbd_567ec2dfd50c3d162018-05-30 · +22dVerified

Name: Global University
norm: global university
Domain: globaluniversity.edu

Name: Global University
norm: global university
Domain: globaluniversity.edu
Industry: Educationllm

Discovered: Feb 1, 2018
Breach occurred: Dec 31, 2017 – Jan 31, 2018
Undetected for: 32 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 8, 2018
Affected individuals: 14,660state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
Regulator citations: Providing written notice of this incident to the FBI, other state regulators, and major consumer reporting agencies

During the incident: Launched an investigation
Working with third-party forensic investigators to confirm the nature and scope of the incident
Providing potentially affected individuals access to one (1) free year of credit monitoring and identity restoration services through AllClear
Established a dedicated hotline for potentially affected individuals
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to the FBI, other state regulators, and major consumer reporting agencies
Changes made: Reviewing its existing policies and procedures
Working to implement additional safeguards to protect the security of information in its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Massachusetts State AGMay 8 · first

Washington State AGMay 8 · first

Montana State AGMay 8 · first

Oregon State AGMay 8 · first

California State AGMay 8 · first · this page

South Carolina State AG+7d

Hawaii State AG+22d

Pattern: first filing May 8 (MA), last May 30 (HI) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-135977
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 8, 2018
Raw hash: f3a9208eaa943b9533f9d9d565beac7b339b6e353de9098b1a0360ec0bae4c49

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityGlobal University

Victim entityGlobal University

Incidentdiscovered Feb 1, 2018

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov