HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)CredentialsLowContained

San José State University

bd_19f2956475a360f0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 10, 2018

Filed

Dec 26, 2018

To disclose

16 days

Affected

Not disclosed

Confidence

65%

Full breach record for San José State University →2 incidents on file

On December 10, 2018, San Jose State University (SJSU) detected unauthorized access to a server operated by its auxiliary, SJSU Associated Students. The attacker accessed names, email addresses, usernames, and passwords. No SSNs, financial, or medical data were involved. SJSU blocked access, disabled credentials, and notified affected individuals on December 26, 2018. Remediation included migrating servers to SJSU infrastructure and conducting security assessments.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 10, 2018 → Notified Dec 26, 201816d ✓ CA 60-day OK16 days discovery → filing

Incident timeline

discovery → filing · 16 days

Dec 10, 2018

Begins

Dec 10, 2018

Discovered

Dec 26, 2018

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: San José State University
norm: san jose state university
Domain: sjsu.edu
Industry: Education

Name: San José State University
norm: san jose state university
Domain: sjsu.edu
Industry: Education
Industry: Educationllm

Discovered: Dec 10, 2018
Breach occurred: Dec 10, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 26, 2018
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Filed notification with California Attorney General
Third party: via SJSU Associated Students

During the incident: Blocked all access to and from the affected server
Began an investigation to determine what happened and what information may have been affected
Disabled affected user credentials
Sent notification emails to affected students, former students, faculty and staff
Provided a telephone number for potentially affected individuals
Posted additional information about the event online
Changes made: Conducting security assessments across third-party entities that are auxiliaries of the University
Isolated and migrated all Associated Students servers into SJSU technology infrastructure
Monitored and managed by SJSU IT
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: CA 60-day OK · 16d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 10, 2018
→ Notified: Dec 26, 2018
16d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 10, 2018 → Notified: Dec 26, 2018	16d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-143171
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 26, 2018
Raw hash: 28816f6d84ddb90d68ed875b4e73edf9de4594faa8dec21e4f44b7e9aeeb8893

Reporting entitySan José State University

Victim entitySan José State University

Incidentdiscovered Dec 10, 2018

Stated responseBlocked all access to and from the affected server

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov