AccidentalTechnologyFinancial ServicesInformationMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDFinancialMediumContained

ScholarChip

bd_12ada67e7b69515d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 6, 2016

Filed

Jan 1, 2017

To disclose

26 days

Affected

10state residents only

Confidence

67%

Full breach record for ScholarChip →

ScholarChip notified the NH Attorney General of a technical issue on its student loan portal that allowed up to 9 borrowers to access other borrowers' PII (names, SSNs, loan info) on Dec 6, 2016. ScholarChip corrected the issue, enhanced security, notified 10 NH residents, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 days

Dec 6, 2016

Discovered

Jan 1, 2017

Filed

vs. sector median

15 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed10 affectedView incident

Name: ScholarChip
norm: scholarchip
Domain: scholarchip.com

Name: ScholarChip
norm: scholarchip
Domain: scholarchip.com
Industry: TechnologyllmFinancial Servicesllm

Discovered: Dec 6, 2016
Materiality determined: —
Notification sent: Jan 27, 2017
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Began an investigation and corrected the technical issue
Enhanced the security of our systems and the process we use to make documents available on the online portal
Provided written notification to the 10 residents of the State of New Hampshire
Offered affected individuals a free one year membership in ProtectMyID credit monitoring and identity theft protection services from Experian
Disclosed this incident to all three consumer reporting agencies
Changes made: Enhanced the security of our systems and the process we use to make documents available on the online portal to prevent a similar incident from ever occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/scholar-chip-20170131.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 1, 2017
Raw hash: 0c7c8813963091b5a2236717d9803eada9a660beaeb26e50a166d331239dde2c

Reporting entityScholarChip

Victim entityScholarChip

Incidentdiscovered Dec 6, 2016

Stated responseBegan an investigation and corrected the technical issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov