HackingEducationEducationVulnerability ExploitCapture Stored DataZero-DayData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Tulane University

bd_2d86ba630666407b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 10, 2025

Filed

Aug 10, 2025

To disclose

≤1 day

Affected

50state residents only

Linked

12 filings

Confidence

66%

Full breach record for Tulane University →3 incidents on file

Tulane University notified affected individuals of a data breach involving a zero-day vulnerability in Oracle’s E-Business Suite. Unauthorized access occurred on August 10, 2025, exposing names, SSNs, and banking information. Tulane notified law enforcement, applied Oracle patches, and engaged third-party vendors. Affected individuals are offered Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · ≤1 day / 0 days

Aug 10, 2025

Begins

Aug 10, 2025

Discovered

Aug 10, 2025

Filed

vs. sector median

7 wks faster

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Nebraska State AGbd_32b6e97a8ca028ed2026-04-02 · +235dVerified
Indiana State AGbd_8475b20e373a308c2026-04-02 · +235dVerified
Illinois State AGbd_395a2448657484512026-05-01 · +264dVerified
Vermont State AGbd_50db809f15fefd3f2026-05-12 · +275dVerified

Show 6 more filings ↓up to 277d gap

Massachusetts State AGbd_60a0e39ce8400e232026-05-12 · +275dVerified
Oregon State AGbd_62e98338ec833caa2026-05-12 · +275dVerified
California State AGbd_6ab4a70206b384932026-05-12 · +275dVerified
Maine State AGbd_806773eacf19677c2026-05-12 · +275dVerified
New Hampshire State AGbd_99d1b59303184ccb2026-05-12 · +275dVerified
Texas State AGbd_ee299b62b535858c2026-05-14 · +277dVerified

Showing first 10 of 11 linked disclosures.

Name: Tulane University
norm: tulane university
Domain: tulane.edu

Name: Tulane University
norm: tulane university
Domain: tulane.edu
Industry: Educationllm

Discovered: Aug 10, 2025
Breach occurred: Aug 10, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 50state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notified law enforcement
Initial access: exploit_public_facing

During the incident: Launched an investigation
Notified law enforcement
Applied patches provided by Oracle
Worked closely with Oracle and third-party cybersecurity vendors
Changes made: Worked closely with Oracle and third-party cybersecurity vendors to ensure the aforementioned vulnerability has been eliminated
Offering complimentary membership of Experian’s IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Montana State AGAug 10 · first · this page

Nebraska State AG+235d

Indiana State AG+235d

Illinois State AG+264d

Vermont State AG+275d

Massachusetts State AG+275d

Oregon State AG+275d

California State AG+275d

Maine State AG+275d

New Hampshire State AG+275d

Texas State AG+277d

Pattern: first filing Aug 10 (MT), last May 14 (TX) — a 277-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/05/Consumer-notification-letter-8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 10, 2025
Raw hash: 0ed0af4c1f9f2d5c310eb4e0e706ad948e4ce0ec22f4b6165b49598cc0a3b1c0

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityTulane University

Victim entityTulane University

Incidentdiscovered Aug 10, 2025

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov