Social EngineeringPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
Tufts University
bd_2902d0da9153c9d5 · schema v1 · pii pii-v1
Full breach record for Tufts University →Tufts University notified Vermont AG of unauthorized access to employee email accounts between Feb 15 and Apr 4, 2025. Attackers accessed emails containing names and financial account info of a limited number of individuals. Incident discovered March 26, 2025. Tufts reset passwords, notified law enforcement, and implemented additional safeguards.
Vermont clock✗ VT AG >45 bday20 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-08-15-trustees-tufts-college-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 15, 2025
- Raw hash
- 44b580802df2079cee6ba134c40ba1befffa42d5419424f5b8fbcac3e9051e2b
Reporting entity
- Name
- TRUSTEES OF TUFTS COLLEGEnorm: trustees of tufts college
Victim entity
- Name
- Tufts Universitynorm: tufts university
- Domain
- tufts.edu
Incident
- Discovered
- Mar 26, 2025
- Materiality determined
- —
- Notification sent
- Aug 15, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- notified law enforcement
- Initial access
- phishing_link
Compliance
- Time to disclose
- 20 weeks(142 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.