HackingEducationEducationVulnerability ExploitStolen CredentialsTargetedDelayed DiscoveryMulti-Stage ChainCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

THE PENNSYLVANIA STATE UNIVERSITY

bd_8120591110fc111c · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 1, 2014

Filed

May 18, 2015

To disclose

28 weeks

Affected

17,933

Confidence

66%

Full breach record for THE PENNSYLVANIA STATE UNIVERSITY →2 incidents on file

Penn State notified NH AG of an APT incident in the College of Engineering. Intrusion detected Nov 2014, potentially active since Sept 2012. PII (SSN, DL, bank/credit card) found on compromised systems around April 2014. 17,933 individuals notified, including 46 NH residents. No evidence of misuse. Forensic experts engaged; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 791 days

discovery → filing · 28 weeks / 198 days

Sep 1, 2012

Begins

Nov 1, 2014

Discovered

May 18, 2015

Filed

vs. sector median

+20 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed17,933 affectedView incident

Name: THE PENNSYLVANIA STATE UNIVERSITY
norm: the pennsylvania state university
Domain: psu.edu

Name: THE PENNSYLVANIA STATE UNIVERSITY
norm: the pennsylvania state university
Domain: psu.edu
Industry: Educationllm

Discovered: Nov 1, 2014
Breach occurred: Sep 1, 2012 – Apr 30, 2014
Undetected for: 791 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 19, 2015
Affected individuals: 17,933state + nationwide
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1074 Data Staged
Threat actor: ExternalEspionage
Regulator citations: Received victim notification report from the Federal Bureau of Investigation (FBI)
Initial access: exploit_public_facing

During the incident: Launched a comprehensive internal investigation
Retained leading third-party computer forensics experts
Conducted a thorough analysis of the College of Engineering’s computer network
Taken steps to restore the integrity of the College’s systems
Alerted all three major credit reporting agencies
Notified affected individuals by U.S. first class mail
Offered free credit monitoring for one year
Changes made: Taken significant steps to fortify the College’s cyber-security defenses
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(198 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pennsylvania-state-20150518.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 18, 2015
Raw hash: a9a2ee66b5110cc06c9047a59e6eee31dabdba6a50c22646a213ec8c11cb71c4

Reporting entityTHE PENNSYLVANIA STATE UNIVERSITY

Victim entityTHE PENNSYLVANIA STATE UNIVERSITY

Incidentdiscovered Nov 1, 2014

Stated responseLaunched a comprehensive internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov