HackingEducationEducationStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

Johnson & Wales University

bd_1ee9a4b8bff93a07 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 11, 2024

Filed

Sep 19, 2024

To disclose

10 weeks

Affected

264state residents only

Linked

6 filings

Confidence

66%

Full breach record for Johnson & Wales University →

Johnson & Wales University notified the NH Attorney General on Sept 19, 2024, of unauthorized network activity discovered July 11, 2024. The incident potentially affected personal information of 264 NH residents. JWU engaged forensic specialists, notified the FBI, and offered 12 months of credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 70 days

Jul 11, 2024

Discovered

Aug 21, 2024

Scope determined

Sep 19, 2024

Filed

vs. sector median

+1 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_3d501478fa8a2c892024-09-19Candidate
Massachusetts State AGbd_650f7a30eb6f74db2024-09-19Verified
Maine State AGbd_69a06102553e497b2024-09-19Verified
Vermont State AGbd_808aca33228f5a052024-09-19Verified

Show 1 more filing ↓

Indiana State AGbd_c97f4023e6eb029c2024-09-19Verified

Name: Johnson & Wales University
norm: johnson wales university
Domain: jwu.edu

Name: Johnson & Wales University
norm: johnson wales university
Domain: jwu.edu
Industry: Educationllm

Discovered: Jul 11, 2024
Materiality determined: Aug 21, 2024
Notification sent: Sep 19, 2024
Affected individuals: 264state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcement (FBI)
Initial access: valid_credentials

During the incident: Engaged digital forensics and incident response specialists
Notified federal law enforcement
Implemented additional safeguards and training
Provided access to credit monitoring services for twelve (12) months through Kroll
Changes made: Working to implement measures to enhance the security of its digital environment
Implemented additional safeguards and training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGSep 19 · first

Massachusetts State AGSep 19 · first

Maine State AGSep 19 · first

Vermont State AGSep 19 · first

Indiana State AGSep 19 · first

New Hampshire State AGSep 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/johnson-wales-university-20240919.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2024
Raw hash: bc33bdb0a3588c54fc58224856686432386da9baca5e9c27ff4d59eee39f1e23

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityJohnson & Wales University

Victim entityJohnson & Wales University

Incidentdiscovered Jul 11, 2024

Stated responseEngaged digital forensics and incident response specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov