HackingEducationEducationVulnerability ExploitDelayed DiscoveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Georgia Institute of Technology

bd_61a2018aa0d12a4e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 31, 2019

Filed

May 22, 2019

To disclose

7 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

64%

Full breach record for Georgia Institute of Technology →

The Georgia Institute of Technology notified California residents of a data breach where an unauthorized person exploited a web server to query an internal database between December 14, 2018, and March 22, 2019. The incident was identified in late March 2019. Affected data included names, addresses, Institute IDs, dates of birth, and Social Security numbers. Georgia Tech engaged forensic firms, secured the server, and offered one year of identity protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 31, 2019 → Notified May 22, 201952d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

undetected · 107 days

discovery → filing · 7 weeks / 52 days

Dec 14, 2018

Begins

Mar 31, 2019

Discovered

May 22, 2019

Filed

vs. sector median

1 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Washington State AGbd_5e308b1e230109a22019-05-22Candidate
Oregon State AGbd_69d11ad986ca01d32019-05-22Verified
Montana State AGbd_e98ad894004145812019-05-22Verified
Massachusetts State AGbd_25a943fa8c699b802019-05-23 · +1dVerified

Show 4 more filings ↓up to 89d gap

New Hampshire State AGbd_09e2725a2c1aa8822019-05-24 · +2dVerified
South Carolina State AGbd_40c8391d08974be62019-06-11 · +20dVerified
Delaware State AGbd_8a1d9df1eb51d81f2019-08-13 · +83dVerified
New Hampshire State AGbd_adc4007cc1f5cd002019-08-19 · +89dVerified

Name: Georgia Institute of Technology
norm: georgia institute of

Name: Georgia Institute of Technology
norm: georgia institute of
Industry: Educationllm

Discovered: Mar 31, 2019
Breach occurred: Dec 14, 2018 – Mar 22, 2019
Undetected for: 107 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 22, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the U.S. Department of Education
Initial access: exploit_public_facing

During the incident: Implemented its incident response protocol
Took steps to secure the web server
Engaged leading forensic firms to assist in the investigation
Notified the U.S. Department of Education
Set up a dedicated website to share preliminary findings
Secured the services of ID Experts to offer complimentary one-year membership of ID Expert’s MyIDCare
Changes made: Taking steps to enhance existing security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: CA 60-day OK · 52d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 31, 2019
→ Notified: May 22, 2019
52d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 31, 2019 → Notified: May 22, 2019	52d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Washington State AGMay 22 · first

Oregon State AGMay 22 · first

Montana State AGMay 22 · first

California State AGMay 22 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+2d

South Carolina State AG+20d

Delaware State AG+83d

New Hampshire State AG+89d

Pattern: first filing May 22 (WA), last Aug 19 (NH) — a 89-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-147461
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 22, 2019
Raw hash: 2fce1abf8c600df293c1653d60599be755a9b6c5bb2f19adac63d3144bc9bca0

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityGeorgia Institute of Technology

Victim entityGeorgia Institute of Technology

Incidentdiscovered Mar 31, 2019

Stated responseImplemented its incident response protocol

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov