HackingEducationEducationVulnerability ExploitData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountHealth (basic)MediumContained

HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION

bd_4b4ffa1708d3e49b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 29, 2020

Filed

Jan 15, 2021

To disclose

17 days

Affected

3state residents only

Linked

2 filings

Confidence

66%

Full breach record for HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION →2 incidents on file

Harvard Business School notified the New Hampshire AG of a data incident involving 3 NH residents. Unauthorized access occurred Dec 21-23, 2020, via a software vendor's vulnerability. Personal data (PII, SSN, financial, health) was downloaded. HBS patched the system, engaged law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 17 days

Dec 21, 2020

Begins

Dec 29, 2020

Discovered

Jan 15, 2021

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_38a233974d7e14682021-01-11 · +4dCandidate

Name: HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION
norm: harvard business school publishing

Name: HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION
norm: harvard business school publishing
Industry: Educationllm

Discovered: Dec 29, 2020
Breach occurred: Dec 21, 2020 – Dec 23, 2020
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 11, 2021
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Launched an investigation
Worked with the vendor to resolve the vulnerability in the software
Coordinating with local and federal law enforcement
Sending the enclosed notification letter, by mail, to three New Hampshire individuals
Offered 24 months of Experian’s® IdentityWorksSM identity protection services at no cost
Changes made: Applied a patch supplied by the vendor to resolve the vulnerability
Vendor changed its anomaly detection routine to run more frequently
Vendor made other security enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGJan 11 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/harvard-business-school-20210115.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 15, 2021
Raw hash: eb2e2bdd9da0ae832005c6d40ae213d6494feaa7f23986ca631381f3032e131a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHARVARD BUSINESS SCHOOL PUBLISHING CORPORATION

Victim entityHARVARD BUSINESS SCHOOL PUBLISHING CORPORATION

Incidentdiscovered Dec 29, 2020

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov