HackingEducationEducationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDCredentialsEducationMediumContained

Cabrillo College

bd_7f970ed41175e165 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 5, 2017

Filed

Oct 5, 2017

To disclose

4 weeks

Affected

1state residents only

Linked

4 filings

Confidence

67%

Full breach record for Cabrillo College →3 incidents on file

Cabrillo Community College notified the NH Attorney General of a security incident discovered on September 5, 2017, where an unauthorized person gained access to a server containing student orientation information. The data exposed included names, dates of birth, email addresses, usernames, passwords, and in some instances, Social Security numbers. One New Hampshire resident was affected. The college disabled the server, investigated, and enhanced system security including password storage. Credit monitoring was offered to those with SSNs involved.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 30 days

Sep 5, 2017

Discovered

Oct 5, 2017

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_043ea643d86f2e182017-10-05Candidate
California State AGbd_2abf103182c6207c2017-10-05Verified
Massachusetts State AGbd_2fe8a55a1d6508fe2017-10-05Verified

Name: Cabrillo College
norm: cabrillo college
Domain: cabrillo.edu

Name: Cabrillo College
norm: cabrillo college
Domain: cabrillo.edu
Industry: Educationllm

Discovered: Sep 5, 2017
Materiality determined: —
Notification sent: Oct 5, 2017
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDCredentialsEducation
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney General

During the incident: Disabled the server
Began an investigation
Mailing letters to the potentially affected individuals
Offering the potentially affected individuals whose Social Security number was involved with a complimentary one-year membership in credit monitoring and identity theft protection services from AllClear ID
Provided a telephone number for potentially affected individuals to call with any questions they may have
Changes made: Enhanced the security of its system
Transitioned to a more secure password storage system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGOct 5 · first

California State AGOct 5 · first

Massachusetts State AGOct 5 · first

New Hampshire State AGOct 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cabrillo-community-20171005.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2017
Raw hash: a192e946d9b6eed05c6faa651a1e432208ca3e9dd44c852bdcebb58e34c458a2

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCabrillo College

Victim entityCabrillo College

Incidentdiscovered Sep 5, 2017

Stated responseDisabled the server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov