HackingEducationEducationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)LowContained

Butler University

bd_37489d61a71a5c3d · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 28, 2023

Filed

Apr 11, 2024

To disclose

19 weeks

Affected

2state residents only

Linked

6 filings

Confidence

66%

Full breach record for Butler University →3 incidents on file

Butler University notified individuals that its third-party vendor, Athletic Trainer System (ATS), was compromised in August 2020. The incident potentially exposed names of student athletes. Butler University contacted law enforcement and offered complimentary credit monitoring via Experian. The breach was discovered in November 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1214 days

discovery → filing · 19 weeks / 135 days

Aug 1, 2020

Begins

Nov 28, 2023

Discovered

Apr 11, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 6 about the same incident.View merged incident

Part of Athletic Trainer System supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_15379581260d3b932024-04-11Candidate
Indiana State AGbd_17407291378201c42024-04-11Verified
New Hampshire State AGbd_6d9acc4e198e50422024-04-11Verified
Vermont State AGbd_8bfeb28f46a087f52024-04-11Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_8beb850292ded01f2024-04-12 · +1dVerified

Name: Butler University
norm: butler university
Domain: butler.edu

Name: Butler University
norm: butler university
Domain: butler.edu
Industry: Educationllm

Discovered: Nov 28, 2023
Breach occurred: Aug 1, 2020
Undetected for: 1,214 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 10, 2024
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Law enforcement has been contacted and has been working with ATS
Initial access: trusted_relationship

During the incident: Acted immediately to seek clarity from ATS on the nature and scope of the potentially impacted data
Providing access to complimentary credit monitoring through Experian
Reviewing the business necessity of sharing any sensitive data with third party vendors
Contacted law enforcement
Changes made: Reviewing the business necessity of sharing any sensitive data with third party vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(135 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGApr 11 · first

Indiana State AGApr 11 · first

New Hampshire State AGApr 11 · first

Vermont State AGApr 11 · first

Montana State AGApr 11 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1278.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2024
Raw hash: 74b6b3d7e26745e58963a6532f4368e97115ba8116404a1ae20f2d7d2dd2b41a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityButler University

Victim entityButler University

Incidentdiscovered Nov 28, 2023

Stated responseActed immediately to seek clarity from ATS on the nature and scope of the potentially impacted data

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov