HackingVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedPIIIDENTITY_BASICLowContained
The Curators of the University of Missouri
bd_3a959c98420de3f4 · schema v1 · pii pii-v1
Full breach record for The Curators of the University of Missouri →University of Missouri confirmed that personal information was acquired by unauthorized individuals via a zero-day vulnerability in Progress Software's MOVEit Transfer application. The University engaged third-party experts, notified law enforcement, took the application offline, and applied patches. Affected individuals are offered two years of identity monitoring through Kroll.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_9e9feecb13b05e12New Hampshire State AGfiled 2023-10-25Verified
- bd_c3de8a40450c33a3Maine State AGfiled 2023-10-24(1d gap)Candidate
- bd_441790aaefd4d414Vermont State AGfiled 2023-10-20(5d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-575638
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 25, 2023
- Raw hash
- 3dbf9350a392611f694406cf62742400833e9ed0600165ba1084ac302f579371
Reporting entity
- Name
- The Curators of the University of Missourinorm: the curators of the university of missouri
Victim entity
- Name
- The Curators of the University of Missourinorm: the curators of the university of missouri
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 21 weeks(147 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.