AccidentalEducationEducationMisdeliveryDelayed DiscoveryIdentity (basic)Government IDFinancial accountHighContained

Columbia University

bd_73ab27b014b3a664 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 16, 2012

Filed

Apr 23, 2012

To disclose

7 days

Affected · nationwide

3,5004 in this filing

Linked

2 filings

Confidence

65%

Full breach record for Columbia University →7 incidents on file

Columbia University notified the NH AG of an inadvertent data exposure on April 23, 2012. A test file containing PII (names, SSNs, bank account numbers) of ~3,500 individuals was placed on a web server in Jan 2010. It was indexed by Google on March 10, 2012, and discovered by the University on April 16, 2012. 4 NH residents were affected. The file was removed, and 2 years of credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 836 days

discovery → filing · 7 days

Jan 1, 2010

Begins

Apr 16, 2012

Discovered

Apr 23, 2012

Filed

vs. sector median

8 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_843f2a3df358f75b2012-04-27 · +4dVerified

Name: Columbia University
norm: columbia university

Name: Columbia University
norm: columbia university
Industry: Educationllm

Discovered: Apr 16, 2012
Breach occurred: Jan 1, 2010 – Mar 10, 2012
Undetected for: 836 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 21, 2012
Affected individuals: 3,500state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection

During the incident: Disabled access to the file
Commenced an investigation into the matter
Removed the file from the server
Worked with Google to remove the information from Google search results, including cached search results
Verified that information was completely removed from the accessible server and from Google cached search results
Verified that information is not currently available elsewhere on the Internet
Changes made: Arranged for two-year subscription to the ProtectMyID Alert service from Experian
Strengthening measures to protect sensitive information, including implementation of additional tools to search for sensitive information inadvertently placed in locations that are not secure
Strengthening policies and procedures on where sensitive information should be stored on systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGApr 23 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/columbia-university-20120423.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 23, 2012
Raw hash: c15079b0d91be3605114db41189a2c99d579cc53d2e3b02df409cf6b030d57c8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityColumbia University

Victim entityColumbia University

Incidentdiscovered Apr 16, 2012

Stated responseDisabled access to the file

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov