HackingRetail & ConsumerRetailStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountGovernment IDMediumActive

StudentCity.com, Inc.

bd_586493b9dbf5e0ee · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 9, 2011

Filed

Jul 1, 2011

To disclose

22 days

Affected

266state residents only

Confidence

67%

Full breach record for StudentCity.com, Inc. →2 incidents on file

StudentCity.com, Inc. notified the NH Attorney General on July 1, 2011, of a data breach affecting 266 NH residents. Discovered June 9, 2011, the incident involved unauthorized access to a database containing names, credit card numbers, and passport numbers. Credit card encryption was broken in some cases. StudentCity engaged Verizon Business for forensics, notified the Secret Service, and offered ID Experts services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 days

Jun 9, 2011

Discovered

Jul 1, 2011

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed266 affectedView incident

Name: Nelson Mullins Riley & Scarborough LLP
norm: nelson mullins riley scarborough

Name: StudentCity.com, Inc.
norm: studentcitycom
Domain: studentcity.com
Industry: Retail & Consumerllm

Discovered: Jun 9, 2011
Materiality determined: —
Notification sent: Jun 11, 2011
Affected individuals: 266state-resident count only
Data types: Identity (basic)Financial accountGovernment ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the U.S. Secret Service to assist in the investigation
Initial access: valid_credentials

During the incident: Immediately took steps to protect all customer data that might have been compromised
Began sending urgent emails to its customers instructing them to check their bank statements on June 11, 2011
Began an intensive internal investigation on June 9, 2011
Contacted the nation's top forensics specialist for credit card breaches that StudentCity could identify (Chris Novak of Verizon Business) on June 10, 2011, and brought Verizon Business to StudentCity's offices to begin its intensive investigation on June 13, 2011
Notified the U.S. Secret Service to assist in the investigation
Informed its merchant bank and all the credit card brands that it accepts of the suspected issue
Set up a website and a call center staffed by Identity Theft Guard Solutions, LLC to offer assistance, and identity restoration services, education and insurance to all students and parents impacted through ID Experts for one full year at no cost
Changes made: Will not be collecting credit card information at all; such information will all be collected by a processor whose sole job is the secure collection and processing of credit card information
Passport numbers will be destroyed following the trips for which they are needed, and will be stored only with strong encryption
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/student-city-20110701.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 1, 2011
Raw hash: 50e872fd460255456fd7b80ceb3b9cbefbe0d72b024503dbbb86c004715e7d9f

Reporting entityNelson Mullins Riley & Scarborough LLP

Victim entityStudentCity.com, Inc.

Incidentdiscovered Jun 9, 2011

Stated responseImmediately took steps to protect all customer data that might have been compromised

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov