MalwareEducationEducationRansomwareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDCredentialsFinancial accountMinorMediumContained

Stanford University's Department of Public Safety

bd_6e8f41e44561ba9b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 27, 2023

Filed

Mar 11, 2024

To disclose

24 weeks

Affected

9state residents only

Linked

2 filings

Confidence

66%

Full breach record for Stanford University's Department of Public Safety →

Stanford University's Department of Public Safety reported a ransomware attack discovered on September 27, 2023. Unauthorized access occurred between May 12 and September 28, 2023. Approximately 9 New Hampshire residents were affected. Data types included SSNs, credit card numbers, usernames/passwords, government IDs, and passport numbers. Stanford engaged CrowdStrike, notified law enforcement, restored systems from backups, and offered credit monitoring and identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 138 days

discovery → filing · 24 weeks / 166 days

May 12, 2023

Begins

Sep 27, 2023

Discovered

Mar 11, 2024

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_ed82bd82bd3355c42024-03-11Candidate

Name: Stanford University's Department of Public Safety
norm: stanford university s department of public safety

Name: Stanford University's Department of Public Safety
norm: stanford university s department of public safety
Industry: Educationllm

Discovered: Sep 27, 2023
Breach occurred: May 12, 2023 – Sep 28, 2023
Undetected for: 138 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 11, 2024
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government IDCredentialsFinancial accountMinor
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: discuss with California law enforcement officials the safeguards that would be required
Initial access: valid_credentials

During the incident: Notified federal and local law enforcement
Engaged legal counsel
Began investigating the incident with the assistance of CrowdStrike
Did not engage with the threat actor or pay any ransom
Conducted a manual review of the impacted data set
Offering identity theft protection services through IDX
Offering credit monitoring services from TransUnion
Changes made: Restoring the DPS systems from secure backups
Taking steps to enhance the network security safeguards at DPS
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(166 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGMar 11 · first

New Hampshire State AGMar 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/stanford-university-dept-public-safety-20240311.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 11, 2024
Raw hash: 31003e24eb48070641330598e7810cbd8ae2179095cdec99d5eb491279ff8b4b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityStanford University's Department of Public Safety

Victim entityStanford University's Department of Public Safety

Incidentdiscovered Sep 27, 2023

Stated responseNotified federal and local law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov