MalwareEducationEducationRansomwareData EncryptedTargetedIdentity (basic)Government IDHealth (basic)HighContained

Whitworth University

bd_57d2ad17d8213096 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 29, 2022

Filed

May 19, 2023

To disclose

42 weeks

Affected

2,425state residents only

Linked

11 filings

Confidence

66%

Full breach record for Whitworth University →

Whitworth University notified the Idaho AG of a ransomware attack detected on July 29, 2022. The incident potentially exposed PII of 2,425 Idaho residents, including names, SSNs, student IDs, passport numbers, and health insurance info. Whitworth engaged forensic experts, rebuilt systems, notified law enforcement and the Dept of Education, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d42 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 42 weeks / 294 days

Jul 29, 2022

Begins

Jul 29, 2022

Discovered

May 19, 2023

Filed

vs. sector median

+35 wks slower

This filing is one of 11 about the same incident.View merged incident

A leak claim by lockbit_3 about this victim predates this filing by 281 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_88fe38d865e0c77d2022-08-10 · +281dCandidate

Regulatory filings (9) · sorted by filing gap

California State AGbd_000f0e63ede62e352023-05-13 · +6dVerified by operator
Maine State AGbd_1b5f2a226647531b2023-05-13 · +6dVerified by operator
Oregon State AGbd_513ded4de33ab4772023-05-13 · +6dVerified by operator
Massachusetts State AGbd_703a926d3e579ba32023-05-13 · +6dVerified by operator

Show 5 more filings ↓up to 227d gap

Montana State AGbd_a95dbb769635964d2023-05-12 · +7dVerified
New Hampshire State AGbd_e0cb1c9df0d3debc2023-05-12 · +7dVerified by operator
Indiana State AGbd_5d844bede7e0dbd92023-04-28 · +21dVerified
Vermont State AGbd_eff70d4adcf75c392023-04-28 · +21dVerified
Washington State AGbd_9ba14f07862a4b382022-10-04 · +227dCandidate

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Whitworth University
norm: whitworth university
Domain: whitworth.edu
Industry: Educationllm

Discovered: Jul 29, 2022
Breach occurred: Jul 29, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 3, 2022
Affected individuals: 2,425state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Law enforcement was notifiedThe Department of Education was also notified and completed an investigation into the incident
Initial access: exploit_public_facing

During the incident: Engaged a team of external forensic and cybersecurity experts to analyze the environment
Conducting a comprehensive investigation into the sensitivity of data accessed
Conducting an investigation with the assistance of third-party forensic specialists
Engaging in steps to confirm the security of any relevant systems
Wiped and rebuilt affected systems
Took additional steps to enhance technical safeguards relating to the security of its systems and servers
Law enforcement was notified
The Department of Education was also notified and completed an investigation into the incident
Changes made: Took additional steps to enhance technical safeguards relating to the security of its systems and servers
Reviewing and altering our policies, procedures, and network security software relating to the security of our systems and servers
Offering free credit monitoring and identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(294 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Washington State AGOct 4 · first

Indiana State AG+206d

Vermont State AG+206d

Montana State AG+220d

New Hampshire State AG+220d

California State AG+221d

Maine State AG+221d

Oregon State AG+221d

Massachusetts State AG+221d

Idaho State AG+227d · this page

Pattern: first filing Oct 4 (WA), last May 19 (ID) — a 227-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2023/05/5-19-2023-Whitworth-University.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 19, 2023
Raw hash: e32572f6a83282e4ee8ce4fad7500d496c9ce84cdc4e37e2a30b5af6af6a11a9

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityWhitworth University

Incidentdiscovered Jul 29, 2022

Stated responseEngaged a team of external forensic and cybersecurity experts to analyze the environment

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov