HackingIdentity (basic)Government IDMediumContained

TRUSTEES OF BOSTON UNIVERSITY

bd_5a72999d31cef493 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Aug 17, 2009

To disclose

—

Affected

47state residents only

Linked

2 filings

Confidence

69%

Full breach record for TRUSTEES OF BOSTON UNIVERSITY →23 incidents on file

Boston University notified the New Hampshire Attorney General of a security incident involving an anonymous FTP server running on a shared Army ROTC Windows desktop. The server permitted public access to personal information, including names, Social Security Numbers, addresses, and dates of birth. Approximately 47 New Hampshire residents were affected. The University secured the server and offered one year of free credit monitoring through Debix, Inc.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Aug 17, 2009

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_1e4f29918e299b1f2009-08-10 · +7dVerified

Name: TRUSTEES OF BOSTON UNIVERSITY
norm: trustees of boston university

Name: TRUSTEES OF BOSTON UNIVERSITY
norm: trustees of boston university

Discovered: —
Materiality determined: —
Notification sent: —
Affected individuals: 47state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the Massachusetts Attorney GeneralNotified the Director of Consumer Affairs and Business Regulation
Initial access: exploit_public_facing

During the incident: Secured the server upon learning of the issue
Notified the Massachusetts Attorney General and the Director of Consumer Affairs and Business Regulation
Offered one year of free credit monitoring to all affected individuals through Debix, Inc.
Sent letters substantially in the form enclosed
Changes made: Secured the server
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGAug 10 · first

New Hampshire State AG+7d · this page

Pattern: first filing Aug 10 (MA), last Aug 17 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/boston-university-20090817.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2009
Raw hash: ff984d9ed0af943dc92896ddfdab4910508ba2a8ab798c8b8f543395990d4c6d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTRUSTEES OF BOSTON UNIVERSITY

Victim entityTRUSTEES OF BOSTON UNIVERSITY

IncidentUnauthorized Access

Stated responseSecured the server upon learning of the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov