HackingEducationEducationVulnerability ExploitCapture Stored DataData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

California State University East Bay

bd_84245076a1e73af7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 17, 2018

Filed

Oct 8, 2018

To disclose

21 days

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for California State University East Bay →2 incidents on file

California State University, East Bay notified the NH AG of a breach affecting 1 NH resident. Unauthorized access occurred between March 27, 2017, and Sept 2, 2018, via a web app exploit. Data exposed: names, addresses, SSNs. Notification sent Oct 5, 2018. Remediation: app removed, vulns mitigated, credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 539 days

discovery → filing · 21 days

Mar 27, 2017

Begins

Sep 17, 2018

Discovered

Oct 8, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_72d941280012d8422018-10-05 · +3dVerified
Montana State AGbd_b8524b432e33abcd2018-10-05 · +3dCandidate
California State AGbd_97b5f2bf6d39667d2018-10-12 · +4dVerified

Name: California State University East Bay
norm: california state university east bay

Name: California State University East Bay
norm: california state university east bay
Industry: Educationllm

Discovered: Sep 17, 2018
Breach occurred: Mar 27, 2017 – Sep 2, 2018
Undetected for: 539 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 5, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Commenced an internal investigation
Began mailing written notifications to potentially affected individuals
Offering potentially affected individuals a complimentary one-year membership in credit monitoring and identity theft protection services from Experian
Provided a telephone number for potentially affected individuals to call with any questions
Taking immediate steps to reevaluate its information security practices
Changes made: The compromised application has been removed from our server
Vulnerabilities have been mitigated
Taking immediate steps to reevaluate its information security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGOct 5 · first

Montana State AGOct 5 · first

New Hampshire State AG+3d · this page

California State AG+7d

Pattern: first filing Oct 5 (MA), last Oct 12 (CA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/california-state-university-20181008.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 8, 2018
Raw hash: 14914a73104715fd5d52f399278e7406236691d5b6c68ad55e3f5438722e59d6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCalifornia State University East Bay

Victim entityCalifornia State University East Bay

Incidentdiscovered Sep 17, 2018

Stated responseCommenced an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov