HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Health (basic)Government IDMediumContained

Rensselaer Polytechnic Institute

bd_1cade7c054a76fac · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 17, 2023

Filed

Feb 1, 2024

To disclose

11 weeks

Affected

2state residents only

Linked

4 filings

Confidence

64%

Full breach record for Rensselaer Polytechnic Institute →2 incidents on file

Rensselaer Polytechnic Institute (RPI) notified students that a third-party vendor, Athletic Trainer System (ATS), experienced a cyber incident between Jan 2020 and Jan 2021. A perpetrator used a 'data miner' tool to collect info from accounts with vulnerable passwords. RPI was notified in Nov 2023. Data included names, DOBs, injury info, and potentially SSNs. RPI mandated MFA and is migrating to a new system.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1416 days

discovery → filing · 11 weeks / 76 days

Jan 1, 2020

Begins

Nov 17, 2023

Discovered

Feb 1, 2024

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Part of Athletic Trainer System supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_747790e80bfa4e6e2024-02-01Verified
Maine State AGbd_8d79f05ec7ca65d22024-02-02 · +1dVerified
New Hampshire State AGbd_bb4e3de0601012b42024-02-02 · +1dVerified

Name: Rensselaer Polytechnic Institute
norm: rensselaer polytechnic institute

Name: Rensselaer Polytechnic Institute
norm: rensselaer polytechnic institute
Industry: Educationllm

Discovered: Nov 17, 2023
Breach occurred: Jan 1, 2020 – Jan 1, 2021
Undetected for: 1,416 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2024
Affected individuals: 2state-resident count only
Data types: Identity (basic)Health (basic)Government ID
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Investigation involving the FBI
Initial access: valid_credentials

During the incident: All staff who have administrative access to this software have been required to change their passwords, use dual factor authentication for access, and ensure compliance with RPI’s password complexity standards.
RPI is transitioning to a new system called PyraMed and will no longer be using the ATS software.
RPI is providing you with information on how you can implement fraud alerts and credit freezes with credit agencies and obtain free credit monitoring services.
Changes made: Transitioning to a new system called PyraMed and will no longer be using the ATS software.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGFeb 1 · first

Montana State AGFeb 1 · first · this page

Maine State AG+1d

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1071.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 1, 2024
Raw hash: b571f416f8ba5d022fccccd06975aa3616cfedb5c5849452cbfde06bfe0539d3

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRensselaer Polytechnic Institute

Victim entityRensselaer Polytechnic Institute

Incidentdiscovered Nov 17, 2023

Stated responseAll staff who have administrative access to this software have been required to change their passwords, use dual factor authentication for access, and ensure compliance with RPI’s password complexity standards.

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov