Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedTargetedEducationIdentity (basic)Government IDHighContained

Portland State University Foundation

bd_7aa45810831a1032 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 1, 2020

Filed

Apr 6, 2021

To disclose

40 weeks

Affected

4,216state residents only

Linked

2 filings

Confidence

71%

Full breach record for Portland State University Foundation →

Portland State University Foundation reported a phishing incident affecting 4,216 Washington residents. Unauthorized actors accessed employee email accounts between May 26 and July 1, 2020. Data exposed included names, addresses, DOBs, student IDs, and SSNs. Notices sent April 6, 2021. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d40 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 36 days

discovery → filing · 40 weeks / 279 days

May 26, 2020

Begins

Jul 1, 2020

Discovered

Apr 6, 2021

Filed

vs. sector median

+31 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_7efbe331eefa5d062021-04-06Verified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Portland State University Foundation
norm: portland state university
Industry: Educationllm

Discovered: Jul 1, 2020
Breach occurred: May 26, 2020 – Jul 1, 2020
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2021
Affected individuals: 4,216state-resident count only
Data types: EducationIdentity (basic)Government ID
Data elements: NameSocial Security numberDate of birthStudent ID number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Provided written notice of this incident to other state regulators
Initial access: phishing_link

During the incident: Launched an investigation to determine the nature and scope of the activity
Commenced an extensive review of the impacted email accounts’ contents
Providing written notice of this incident to all affected individuals
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for twelve (12) months, through Epiq, to individuals whose Social Security number, driver’s license number, or passport number were potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to other state regulators
Changes made: Implementing additional safeguards and training to its employees
Reviewing existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(279 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGApr 6 · first

Washington State AGApr 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10440.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2021
Raw hash: 42c08a93850d2bf64d67199ecdf1508d8a97c2781434bde63946f810391f2287

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityPortland State University Foundation

Incidentdiscovered Jul 1, 2020

Stated responseLaunched an investigation to determine the nature and scope of the activity

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com