Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumActive

College of the Holy Cross

bd_89262d7738375d4f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 12, 2011

Filed

Oct 7, 2011

To disclose

25 days

Affected · nationwide

4934 in this filing

Linked

2 filings

Confidence

64%

Full breach record for College of the Holy Cross →3 incidents on file

College of the Holy Cross notified NH AG of a phishing incident where an HR staff member provided credentials to a fraudulent 'System Administrator' email. 7 staff accounts were compromised; emails were erased. Personal info (name, SSN, driver's license, financial account) of 4 NH residents and 493 individuals in other jurisdictions was exposed. Notifications sent Oct 6, 2011. Forensic experts and legal counsel retained; FBI/FTC contacted.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 25 days

Sep 9, 2011

Begins

Sep 12, 2011

Discovered

Oct 7, 2011

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_d2c6d343d83c8a6f2011-10-13 · +6dVerified

Name: College of the Holy Cross
norm: college of the holy cross

Name: College of the Holy Cross
norm: college of the holy cross
Industry: Educationllm

Discovered: Sep 12, 2011
Breach occurred: Sep 9, 2011 – Sep 10, 2011
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 6, 2011
Affected individuals: 493state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralPrivacy counsel contacted the FBIContacting the FTCPublic Safety Chief filing a report with the local police department in Worcester
Initial access: phishing_link

During the incident: Retained computer forensic experts, Cybertrust
Retained breach notification legal counsel, Nelson, Levine, de Luca & Horst, LLC
Notified the FBI
Contacting the FTC
Public Safety Chief filing a report with the local police department in Worcester
Offering one year of credit monitoring services, identity fraud insurance and identity restoration assistance
Changes made: Required immediate retraining on the Written Information Security Plan for all staff members whose email accounts were improperly accessed
Created a new webpage for cyber awareness
Notified the entire Holy Cross Community by email of additional 'phishing' attacks
Placed posters throughout the campus regarding 'phishing' attacks and security of personal information
Created a procedure to ensure all HR employees re-read Policies and procedures: WISP, HR Data handling procedures, Data Retention policies, Data Classification policies, and Data Destruction policies
Conducted 1-hour lecture presented to Human Resources Department on Massachusetts Data Security Law and encryption
Purchased SANS 'Securing the Human' mandatory online training for the entire College
Blocked all electronic communications from the continent of Africa as a temporary measure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 7 · first · this page

Massachusetts State AG+6d

Pattern: first filing Oct 7 (NH), last Oct 13 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/college-holy-cross-20111007.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 7, 2011
Raw hash: e3edc0fffab1d38ffa04f2edf21f7f0d5d4c5bbb4361229e1da33eacb7c2cfea

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCollege of the Holy Cross

Victim entityCollege of the Holy Cross

Incidentdiscovered Sep 12, 2011

Stated responseRetained computer forensic experts, Cybertrust

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov