HackingEducationEducationVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedTargetedIdentity (basic)Government IDMediumContained

Hobart and William Smith Colleges

bd_19bd0484867d675f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 24, 2021

Filed

Apr 12, 2021

To disclose

19 days

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Hobart and William Smith Colleges →2 incidents on file

Hobart and William Smith Colleges notified NH AG of a breach involving its third-party vendor Accellion. An unauthorized party exploited a vulnerability in the Accellion File Transfer Appliance on Jan 20, 2021, accessing files containing one NH resident's name and SSN. Notification sent April 9, 2021. Remediation: FTA taken offline.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 63 days

discovery → filing · 19 days

Jan 20, 2021

Begins

Mar 24, 2021

Discovered

Apr 12, 2021

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Part of Accellion supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_f1d56ca315ee32682021-04-09 · +3dVerified

Name: Hobart and William Smith Colleges
norm: hobart and william smith colleges

Name: Hobart and William Smith Colleges
norm: hobart and william smith colleges
Industry: Educationllm

Discovered: Mar 24, 2021
Breach occurred: Jan 20, 2021
Undetected for: 63 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 9, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Contacted law enforcement
Launched an investigation
Provided written notice via United States Postal Service mail to the New Hampshire resident
Offered a complimentary one-year membership in credit monitoring and identity theft protection services through Experian
Changes made: Took the Accellion FTA offline permanently
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 9 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hobart-william-smith-20210412.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 12, 2021
Raw hash: a26d0a65522916a7c29227dacff688dc5d060022932a62aaaa25666e8f98c37f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHobart and William Smith Colleges

Victim entityHobart and William Smith Colleges

Incidentdiscovered Mar 24, 2021

Stated responseContacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov