AccidentalEducationEducationMisdeliveryCustomer Data InvolvedHealth (basic)Identity (basic)PHILowResolved

University of Washington

bd_2ebc22fca12b3f00 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 4, 2022

Filed

Feb 17, 2023

To disclose

13 months

Affected

534state residents only

Confidence

71%

Full breach record for University of Washington →7 incidents on file

University of Washington inadvertently uploaded a research data file containing personal and health information of 534 individuals to a public website on Feb 4, 2022. The file was removed within minutes. Notifications were sent to affected individuals in 2023. Data included names, DOB, addresses, phone numbers, and COVID-19 test results.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d13 months discovery → filing

Incident timeline

discovery → filing · 13 months / 378 days

Feb 4, 2022

Begins

Feb 4, 2022

Discovered

Feb 17, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed534 affectedView incident

Name: University of Washington
norm: university of washington
Domain: uwmedicine.org

Name: University of Washington
norm: university of washington
Domain: uwmedicine.org
Industry: Educationllm

Discovered: Feb 4, 2022
Breach occurred: Feb 4, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 17, 2023
Affected individuals: 534state-resident count only
Data types: Identity (basic)Health (basic)
Data elements: NameDate of birthMedical information
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 1-99dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Reported to the UW Human Subjects DivisionReported to the UW Privacy OfficeCoordinated next steps with the Institutional Review Board

During the incident: Removed the data file from the website
Instructed website administrators to delete the data file
Reported event to the UW Human Subjects Division and the UW Privacy Office
Conducted joint investigation
Implemented additional data checks
Updated workflows and processes
Developed procedures to de-identify personal data
Changes made: Implemented additional data checks
Updated workflows and processes
Developed procedures to de-identify personal data during certain phases of their work
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(378 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19947.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 17, 2023
Raw hash: 8fb27a884f47b4a8a4eb42d680b9926d6a035a461701eb131db3c7bb69dce437

Reporting entityUniversity of Washington

Victim entityUniversity of Washington

Incidentdiscovered Feb 4, 2022

Stated responseRemoved the data file from the website

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com