AccidentalEducationEducationMisconfigurationDelayed DiscoveryEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PIIMediumContained

Stanford University

bd_235151ef407059c4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 27, 2017

Filed

Dec 22, 2017

To disclose

8 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Stanford University →8 incidents on file

Stanford University notified individuals that personal information, including names, passport numbers, visa numbers, health insurance details, and Social Security numbers, was accessible to GSB faculty, staff, and students due to incorrect folder permissions on a shared file server. The exposure occurred between 2000 and early December 2017. The University Privacy Office received a report on October 27, 2017. Files were removed, and credit monitoring was offered.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 27, 2017 → Notified Dec 20, 201754d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 6509 days

discovery → filing · 8 weeks / 56 days

Jan 1, 2000

Begins

Oct 27, 2017

Discovered

Dec 22, 2017

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Stanford University
norm: stanford university
Domain: stanford.edu

Name: Stanford University
norm: stanford university
Domain: stanford.edu
Industry: Educationllm

Discovered: Oct 27, 2017
Breach occurred: Jan 1, 2000 – Dec 1, 2017
Undetected for: 6,509 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 20, 2017
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security number
Attack vector: Misconfiguration

During the incident: Removed exposed files from the shared environment
Engaged a third-party forensics team
Verified that the current traveler Personal Information Form sits in a secured environment with limited accessibility
Engaged a data forensics firm to identify personally identifiable information in the accessible files and to validate file permissions
Providing credit monitoring and credit repair services
Changes made: University CIO Council will review and make recommendations for enhancing secure file sharing across the university
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: CA 60-day OK · 54d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 27, 2017
→ Notified: Dec 20, 2017
54d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 27, 2017 → Notified: Dec 20, 2017	54d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-131599
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2017
Raw hash: 86437305d8350d6bfcdaf38f094d2b42a21a3de1da7be37817efeec93acf4518

Reporting entityStanford University

Victim entityStanford University

Incidentdiscovered Oct 27, 2017

Stated responseRemoved exposed files from the shared environment

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov