AccidentalEducationEducationMisconfigurationDelayed DiscoveryIdentity (basic)Government IDEducationMediumContained

Eastern New Mexico University

bd_857acad1a8450fd5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 14, 2021

Filed

Sep 16, 2021

To disclose

9 weeks

Affected

2state residents only

Linked

4 filings

Confidence

65%

Full breach record for Eastern New Mexico University →

Eastern New Mexico University notified Montana residents that a spreadsheet containing student PII (SSN, grades, test scores) was accidentally accessible on its public website. The data was originally posted in July 2016 during a migration but discovered in July 2021. The university removed the file, investigated, and offered one year of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1839 days

discovery → filing · 9 weeks / 64 days

Jul 1, 2016

Begins

Jul 14, 2021

Discovered

Sep 16, 2021

Filed

vs. sector median

+1 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_52f82fec464e24022021-09-16Verified
Massachusetts State AGbd_a357affa7b6173242021-09-16Verified
Maine State AGbd_f03d0c7e67b1dbba2021-09-16Verified

Name: Eastern New Mexico University
norm: eastern new mexico university

Name: Eastern New Mexico University
norm: eastern new mexico university
Industry: Educationllm

Discovered: Jul 14, 2021
Breach occurred: Jul 1, 2016
Undetected for: 1,839 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 9, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDEducation
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External

During the incident: Removed the spreadsheet from our website
Launched an investigation
Offering you a complimentary one-year membership with Experian’s® IdentityWorksSM
Changes made: Implemented additional safeguards and technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 16 · first

Massachusetts State AGSep 16 · first

Maine State AGSep 16 · first

Montana State AGSep 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-105.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2021
Raw hash: 551e17e311447a56bcb02ba137986eb57e7e7d5672d4232897dcc985b4733745

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityEastern New Mexico University

Victim entityEastern New Mexico University

Incidentdiscovered Jul 14, 2021

Stated responseRemoved the spreadsheet from our website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov