Social EngineeringEducationEducationPhishingTargetedIdentity (basic)PIILowContained

Colorado State University - Pueblo

bd_0ad8be01d2f0f941 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 14, 2024

Filed

Sep 5, 2024

To disclose

22 days

Affected

10state residents only

Linked

5 filings

Confidence

65%

Full breach record for Colorado State University - Pueblo →

Colorado State University – Pueblo notified affected individuals of a cybersecurity incident on August 14, 2024. Employees were targeted by a social engineering attack, resulting in unauthorized access to an unprotected Excel spreadsheet containing student names, ID numbers, and billing balances. No university systems were breached. The incident was limited in scope.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 days

Aug 14, 2024

Begins

Aug 14, 2024

Discovered

Sep 5, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_d5c69f32d4ae7ba32024-09-05Verified
New Hampshire State AGbd_f5d8040d4a3cf6da2024-09-05Verified
Vermont State AGbd_e08271f0e5d8cffb2024-09-04 · +1dVerified
Indiana State AGbd_4cbc52f0b9c4f0fa2024-08-18 · +18dVerified

Name: The Board of Governors of the Colorado State University System
norm: the board of governors of the colorado state university system
Domain: csusystem.edu
Industry: education

Name: Colorado State University - Pueblo
norm: colorado state university pueblo
Domain: csupueblo.edu
Industry: education
Industry: Educationllm

Discovered: Aug 14, 2024
Breach occurred: Aug 14, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 10state-resident count only
Data types: Identity (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Providing information for you to remain vigilant against future social engineering campaigns
Directing individuals to contact Financial Aid office to confirm suspicious communications
Directing individuals to contact Student Billing office to confirm suspicious communications
Directing individuals to review information through PAWS portal account
Directing individuals to visit CSU System webpage for mitigation information
Directing individuals to contact credit reporting agencies for fraud alerts and security freezes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGAug 18 · first

Vermont State AG+17d

Massachusetts State AG+18d

New Hampshire State AG+18d

Montana State AG+18d · this page

Pattern: first filing Aug 18 (IN), last Sep 5 (MT) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1658.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2024
Raw hash: f6af0ed53e23b10602fa6b197a9356de0eeb53a78fc716aba01c3e308c3a6f43

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityThe Board of Governors of the Colorado State University System

Victim entityColorado State University - Pueblo

Incidentdiscovered Aug 14, 2024

Stated responseProviding information for you to remain vigilant against future social engineering campaigns

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov