HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)LowContained

Butler University

bd_6d9acc4e198e5042 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 28, 2023

Filed

Apr 11, 2024

To disclose

19 weeks

Affected

7state residents only

Linked

6 filings

Confidence

66%

Full breach record for Butler University →3 incidents on file

Butler University notified New Hampshire residents of a data breach involving its third-party vendor, Athletic Trainer System (ATS). An unknown actor accessed ATS systems in August 2020, potentially exposing student-athlete personal information (names). Butler notified law enforcement in November 2023 and sent notices to NH residents in April 2024, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1214 days

discovery → filing · 19 weeks / 135 days

Aug 1, 2020

Begins

Nov 28, 2023

Discovered

Apr 11, 2024

Filed

vs. sector median

+9 wks slower

This filing is one of 6 about the same incident.View merged incident

Part of Athletic Trainer System supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_15379581260d3b932024-04-11Candidate
Indiana State AGbd_17407291378201c42024-04-11Verified
Montana State AGbd_37489d61a71a5c3d2024-04-11Verified
Vermont State AGbd_8bfeb28f46a087f52024-04-11Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_8beb850292ded01f2024-04-12 · +1dVerified

Name: Butler University
norm: butler university
Domain: butler.edu

Name: Butler University
norm: butler university
Domain: butler.edu
Industry: Educationllm

Discovered: Nov 28, 2023
Breach occurred: Aug 1, 2020
Undetected for: 1,214 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 11, 2024
Affected individuals: 7state-resident count only
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified law enforcementProvided written notice to relevant state and federal regulators
Third party: via Athletic Trainer System
Initial access: supply_chain

During the incident: Contacted law enforcement
Provided access to credit monitoring services through Experian
Provided guidance on how to better protect against identity theft and fraud
Provided written notice to relevant state and federal regulators
Provided written notice to the three major credit reporting agencies
Changes made: Reviewing the business necessity of sharing any sensitive data with third party vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(135 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGApr 11 · first

Indiana State AGApr 11 · first

Montana State AGApr 11 · first

Vermont State AGApr 11 · first

New Hampshire State AGApr 11 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/butler-university-20240411.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2024
Raw hash: bdb392bcf5968b380cde276db2964bcd05d83b3cc48d23ab5e1611ee9131e772

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityButler University

Victim entityButler University

Incidentdiscovered Nov 28, 2023

Stated responseContacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov