Social EngineeringTechnologyProfessional ServicesInformationPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PIIMediumContained

Strategic Technology Institute, Inc.

bd_0e0e4d4a759e99fe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 25, 2021

Filed

Aug 23, 2021

To disclose

8 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Strategic Technology Institute, Inc. →

Strategic Technology Institute, Inc. notified employees of a June 25, 2021 incident where an HR email account was compromised via phishing. Potentially exposed data included names, SSNs, addresses, and for some, medical diagnoses. The company terminated the account, enforced 2FA, and restricted file access. No specific count of affected individuals was disclosed.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

Jun 25, 2021

Discovered

Aug 23, 2021

Filed

vs. sector median

10 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_579de34d8ea600202021-08-23Verified
Indiana State AGbd_d86fb0361fdb3e192021-08-23Verified
New Hampshire State AGbd_82ca208896d6e7ae2021-08-30 · +7dVerified

Name: Strategic Technology Institute, Inc.
norm: strategic technology institute

Name: Strategic Technology Institute, Inc.
norm: strategic technology institute
Industry: TechnologyllmProfessional Servicesllm

Discovered: Jun 25, 2021
Materiality determined: —
Notification sent: Aug 23, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Terminate the compromised account
Secured account logins
Updated policy to require 2-Factor Authentication (2FA)
Implemented restricted access to files containing employee information
Contacted legal counsel
Changes made: Implemented 2-Factor Authentication (2FA) for employee accounts
Restricted access to files containing employee information when sent to external organizations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGAug 23 · first

Indiana State AGAug 23 · first

Montana State AGAug 23 · first · this page

New Hampshire State AG+7d

Pattern: first filing Aug 23 (MA), last Aug 30 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-76.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 23, 2021
Raw hash: dc033ebb38373d5bd790d8f1be3d2acf1f7d826012de4c8f32570bdc17f28b8b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityStrategic Technology Institute, Inc.

Victim entityStrategic Technology Institute, Inc.

Incidentdiscovered Jun 25, 2021

Stated responseTerminate the compromised account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov