Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedTargetedPIIIdentity (basic)LowContained

Indiana University

bd_28227bc73a24af5c · schema v1 · pii pii-v1

Severity

Low

Discovered

May 1, 2024

Filed

Jun 25, 2024

To disclose

8 weeks

Affected

2state residents only

Linked

3 filings

Confidence

67%

Full breach record for Indiana University →12 incidents on file

Indiana University Foundation notified NH AG of a data incident discovered May 1, 2024, involving an employee's compromised personal email account. Two NH residents were affected. IUF secured the account, reset credentials, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 55 days

May 1, 2024

Discovered

Jun 25, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_ab76eb36eb16da502024-06-20 · +5dVerified
Massachusetts State AGbd_b91546a109b1d3382024-06-20 · +5dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Indiana University
norm: indiana university
Domain: iu.edu
Industry: Educationllm

Discovered: May 1, 2024
Materiality determined: —
Notification sent: Jun 20, 2024
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Secured the compromised account
Engaged the IUF’s internal IT Security team to conduct a comprehensive investigation
Updated associated user credentials
Deleted IUF data from the compromised mailbox
Identified which emails may have been compromised
Posted an announcement urging employees to purge IUF and Indiana University data from any unsecure or personal, non-IUF email accounts
Offered complimentary credit monitoring and identity theft restoration services through CyberScout
Changes made: Enhanced security measures
Implemented additional mandatory employee training around the proper handling of IUF/IU data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJun 20 · first

Massachusetts State AGJun 20 · first

New Hampshire State AG+5d · this page

Pattern: first filing Jun 20 (IN), last Jun 25 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/indiana-university-foundation-20240625.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 25, 2024
Raw hash: 6dc9e69701d058ebd42301aeb05d5664d4cc71f3a23eee70a8ac52a6d4f45754

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityIndiana University

Incidentdiscovered May 1, 2024

Stated responseSecured the compromised account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov