HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentMediumActive

Loyola University Chicago

bd_3cd75aae86e56baf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 17, 2018

Filed

Jul 30, 2018

To disclose

13 days

Affected

55state residents only

Linked

5 filings

Confidence

63%

Loyola University Chicago issued a supplemental notice regarding unauthorized access to HR data on July 17, 2018. The incident affected current and former employees, exposing PII including SSNs, DOBs, and compensation data. The university engaged in investigation and offered one year of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 days

Jul 17, 2018

Begins

Jul 17, 2018

Discovered

Jul 30, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_0867b7e481b0e6ce2018-07-30Verified
Massachusetts State AGbd_3d9d3abb5faf53fb2018-07-30Verified
New Hampshire State AGbd_bc629abe00f8818d2018-07-30Verified
Massachusetts State AGbd_be1320f2bb0919c42018-09-21 · +53dVerified by operator

Name: Loyola University Chicago
norm: loyola university chicago
Domain: luc.edu

Name: Loyola University Chicago
norm: loyola university chicago
Domain: luc.edu
Industry: Educationllm

Discovered: Jul 17, 2018
Breach occurred: Jul 17, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 26, 2018
Affected individuals: 55state-resident count only
Data types: Identity (basic)Government IDEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Began an investigation
Continuing to investigate this matter
Increasing information security awareness training
Identifying additional technology measures
Contracted with ConsumerInfo.com, Inc., also known as Experian Consumer Services, to provide you with a complimentary one-year identity restoration and credit monitoring membership via Experian IdentityWorks
Monitoring its systems for unlawful attacks
Implementing new technologies intended to defeat such attacks
Changes made: Increasing information security awareness training
Identifying additional technology measures that will strengthen our information security posture
Implementing new technologies intended to defeat such attacks and protect the personal information of University faculty, staff, and students
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

California State AGJul 30 · first

Massachusetts State AGJul 30 · first

New Hampshire State AGJul 30 · first

Montana State AGJul 30 · first · this page

Massachusetts State AG+53d

Pattern: first filing Jul 30 (CA), last Sep 21 (MA) — a 53-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Loyola-Univ-of-Chicago.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2018
Raw hash: b534654eb26893d8be4b194f26c8fabd0d7cdb0fbecd19baba06c36563a845a8

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLoyola University Chicago

Victim entityLoyola University Chicago

Incidentdiscovered Jul 17, 2018

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov