Social EngineeringEducationEducationPhishingEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)HighContained

Tuskegee University

bd_72424c9d3b8c8e3d · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 12, 2018

Filed

Jun 22, 2018

To disclose

15 weeks

Affected

1,152state residents only

Linked

3 filings

Confidence

66%

Full breach record for Tuskegee University →2 incidents on file

Tuskegee University experienced a phishing attack resulting in unauthorized access to 48 faculty and staff email accounts between September 24, 2017, and March 22, 2018. The incident was discovered on March 12, 2018. Affected data included names, addresses, Social Security numbers, financial account information, medical information, Driver’s License numbers, and credit/debit card numbers. 1,152 California residents were notified. The university engaged forensic investigators, reset credentials, implemented MFA, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 12, 2018 → Notified Jun 21, 2018101d ✗ CA 60-day late15 weeks discovery → filing

Incident timeline

undetected · 169 days

discovery → filing · 15 weeks / 102 days

Sep 24, 2017

Begins

Mar 12, 2018

Discovered

Jun 22, 2018

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_d3ad3a17f038a4d42018-06-22Verified
New Hampshire State AGbd_dddadee9cbcc73b52018-06-22Verified

Name: Tuskegee University
norm: tuskegee university
Domain: tuskegee.edu

Name: Tuskegee University
norm: tuskegee university
Domain: tuskegee.edu
Industry: Educationllm

Discovered: Mar 12, 2018
Breach occurred: Sep 24, 2017 – Mar 22, 2018
Undetected for: 169 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 21, 2018
Affected individuals: 1,152state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Launched an investigation to confirm the security of their network and to determine the nature and scope of this event
Engaged third-party forensic investigators
Changed the log-in credentials for those email accounts impacted by this incident to prevent further unauthorized access
Providing access to credit monitoring services for one (1) year, through Experian, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implement additional safeguards and training to its employees
Enhance security controls and to implement additional controls, including use of multi-factor authentications to help protect employee email accounts from unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(102 days from discovery to filing)
Compliance flags: CA 60-day late · 101d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 12, 2018
→ Notified: Jun 21, 2018
101d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 12, 2018 → Notified: Jun 21, 2018	101d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJun 22 · first

New Hampshire State AGJun 22 · first

California State AGJun 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-137340
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2018
Raw hash: a2837684df96a82257bcefc4c917d22fb380cfcde52a40ec9aad20e20635a559

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTuskegee University

Victim entityTuskegee University

Incidentdiscovered Mar 12, 2018

Stated responseLaunched an investigation to confirm the security of their network and to determine the nature and scope of this event

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov