Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

University of Missouri Columbia School of Medicine

bd_2d3d71ba1a219b3c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2019

Filed

Jul 29, 2019

To disclose

13 days

Affected

5state residents only

Confidence

65%

University of Missouri Columbia School of Medicine notified Montana residents that unauthorized access to two employee email accounts occurred between April 16-30, 2019. The incident was discovered on July 16, 2019. Student PII was potentially exposed. No evidence of misuse was found. Credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 91 days

discovery → filing · 13 days

Apr 16, 2019

Begins

Jul 16, 2019

Discovered

Jul 29, 2019

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5 affectedView incident

Name: The Curators of the University of Missouri
norm: the curators of the university of missouri

Name: University of Missouri Columbia School of Medicine
norm: university of missouri columbia school of medicine
Industry: Educationllm

Discovered: Jul 16, 2019
Breach occurred: Apr 16, 2019 – Apr 30, 2019
Undetected for: 91 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 5state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Secured the employees’ accounts
Launched an investigation
Conducted a comprehensive review of the accounts
Offering you a complimentary one-year credit monitoring membership with Experian’s® IdentityWorksSM
Reinforced education with our staff regarding how to identify and avoid suspicious emails
Making additional security enhancements
Changes made: Reinforced education with our staff regarding how to identify and avoid suspicious emails
Making additional security enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Data-Breach-NotificationDetails.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 29, 2019
Raw hash: 20325bda9c43486ae8f3f6766bd85824a2fb4c2b18ce6e67b632b3a9ed8743fa

Reporting entityThe Curators of the University of Missouri

Victim entityUniversity of Missouri Columbia School of Medicine

Incidentdiscovered Jul 16, 2019

Stated responseSecured the employees’ accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov