AccidentalEducationEducationMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

The Board of Trustees of Illinois State University

bd_4d0f330e4f10de8c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 15, 2018

Filed

Mar 5, 2019

To disclose

16 weeks

Affected

1state residents only

Confidence

64%

Full breach record for The Board of Trustees of Illinois State University →

Illinois State University notified individuals of a data exposure incident caused by a vendor software update on November 15, 2018. The misconfiguration potentially exposed names and Social Security numbers to other logged-in users. No evidence of misuse was found. The university engaged a security firm, remediated the update, and offered one year of Experian IdentityWorks credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 110 days

Nov 15, 2018

Begins

Nov 15, 2018

Discovered

Mar 5, 2019

Filed

vs. sector median

+9 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: The Board of Trustees of Illinois State University
norm: the board of trustees of illinois state university

Name: The Board of Trustees of Illinois State University
norm: the board of trustees of illinois state university
Industry: Educationllm

Discovered: Nov 15, 2018
Breach occurred: Nov 15, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 11, 2019
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application

During the incident: Completed investigation with the assistance of a leading computer security firm and the vendor
Remedied the problem caused by the vendor software update
Arranged for complimentary one-year membership of Experian’s IdentityWorks Credit 3B
Worked with vendor to resolve the issue with the update and enhance procedures related to future system updates
Changes made: Enhanced vendor procedures related to future system updates
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-ISU-MT-AG-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 5, 2019
Raw hash: fb5f2290418249a74044fd38bd482901eb47221910f1339b11e97b5045de1d6c

Reporting entityThe Board of Trustees of Illinois State University

Victim entityThe Board of Trustees of Illinois State University

Incidentdiscovered Nov 15, 2018

Stated responseCompleted investigation with the assistance of a leading computer security firm and the vendor

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov