Social EngineeringHealthcareEducationHealthcarePhishingStolen CredentialsTargetedData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIFinancial accountMediumContained

August University

bd_8370d3f77e81490a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 31, 2018

Filed

Aug 30, 2018

To disclose

4 weeks

Affected

15state residents only

Confidence

65%

Full breach record for August University →

Augusta University notified affected individuals of a phishing attack in September 2017 that compromised internal email accounts. The incident exposed PHI and PII including names, SSNs, DOBs, driver's licenses, and medical records. The university engaged forensic professionals, disabled accounts, and implemented MFA and enhanced training. Notices were sent in August 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 324 days

discovery → filing · 4 weeks / 30 days

Sep 10, 2017

Begins

Jul 31, 2018

Discovered

Aug 30, 2018

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed15 affectedView incident

Name: August University
norm: august university
Domain: augusta.edu

Name: August University
norm: august university
Domain: augusta.edu
Industry: HealthcarellmEducationllm

Discovered: Jul 31, 2018
Breach occurred: Sep 10, 2017 – Sep 11, 2017
Undetected for: 324 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 22, 2018
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHIFinancial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Disabling the impacted email accounts
Requiring password changes for the compromised accounts
Maintaining heightened monitoring of the accounts
Working closely with external cybersecurity professionals
Changes made: Installing new leadership in a number of critical areas
Implementing multifactor authentication for off-campus email and system access
Review and adoption of solutions to limit email retention
Implementing policy and procedure changes regarding protected health information in email communications
Employing software to screen emails for protected health information or personally identifiable information to prevent them from sending
Increasing employee training on their critical role in preventing security breaches
Enhancing our compliance-related policies and procedures
Offering a free one-year membership for credit monitoring through Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-90.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 30, 2018
Raw hash: 4e4d46f816d604e3dd65f9da5043e9ee893b3f01f233f065871c2c61993b3cc5

Reporting entityAugust University

Victim entityAugust University

Incidentdiscovered Jul 31, 2018

Stated responseDisabling the impacted email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov