MalwareEducationEducationRansomwareData EncryptedTargetedIdentity (basic)Government IDMediumActive

Oregon Institute of Technology

bd_3d873a9544db0c01 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 25, 2018

Filed

Apr 22, 2019

To disclose

26 weeks

Affected

1state residents only

Linked

5 filings

Confidence

65%

Full breach record for Oregon Institute of Technology →

Oregon Institute of Technology notified NH AG of a data incident affecting 1 NH resident. Unauthorized access occurred Oct 19-23, 2018, detected Oct 25, 2018. Systems infected with virus; personal info (name, address, SSN) present. No evidence of misuse. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 26 weeks / 179 days

Oct 19, 2018

Begins

Oct 25, 2018

Discovered

Apr 22, 2019

Filed

vs. sector median

+17 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_dc327516f683d50a2019-04-19 · +3dCandidate
Oregon State AGbd_27acccd7a5bc0e422019-04-18 · +4dCandidate
Massachusetts State AGbd_c45783373900bd8f2019-04-18 · +4dVerified
Montana State AGbd_d16cb37ff58e75cc2019-04-18 · +4dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Oregon Institute of Technology
norm: oregon institute of
Industry: Educationllm

Discovered: Oct 25, 2018
Breach occurred: Oct 19, 2018 – Oct 23, 2018
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 18, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Working with third-party forensic investigators to confirm the nature and scope of this incident
Conducting additional employee training on data privacy and security
Providing access to credit monitoring services for one (1) year, through Kroll
Notified law enforcement of this incident
Changes made: Reviewing its security policies and procedures
Reassessing its technical, administrative, and physical safeguards to identify and implement further security enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(179 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Oregon State AGApr 18 · first

Massachusetts State AGApr 18 · first

Montana State AGApr 18 · first

Oregon State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/oregon-tech-20190422.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2019
Raw hash: 37a87c73ff1890d7db268f46059b32134900872cbe38cab1c8724a25b2b3c044

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityOregon Institute of Technology

Incidentdiscovered Oct 25, 2018

Stated responseWorking with third-party forensic investigators to confirm the nature and scope of this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov