HackingEducationEducationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Texas Tech University Health Sciences Center

bd_8dc4d5429ac7975f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 17, 2024

Filed

Apr 9, 2026

To disclose

19 months

Affected

511state residents only

Linked

19 records

Confidence

69%

Full breach record for Texas Tech University Health Sciences Center →5 incidents on file

Texas Tech University Health Sciences Center notified Washington AG of a cybersecurity event between Sept 17-29, 2024, affecting 511 WA residents. Data included PII, SSNs, driver's licenses, financial and medical info. Investigation concluded Jan 2026. Notices sent Nov 2024 and April 2026. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d19 months discovery → filing

Incident timeline

discovery → filing · 19 months / 569 days

Sep 17, 2024

Begins

Sep 17, 2024

Discovered

Apr 9, 2026

Filed

This filing is one of 19 records about the same incident.View merged incident

A leak claim by interlock about this victim was first seen 529 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Vermont State AGbd_089646818ad5fad52026-04-24 · +15dVerified
New Hampshire State AGbd_449641a5d71e4b662026-04-24 · +15dVerified by operator
Oregon State AGbd_8bb2d9eda10bb2a12026-04-24 · +15dVerified by operator
California State AGbd_d650ce20ce73e9162026-04-24 · +15dVerified by operator

Show 6 more filings ↓up to 440d gap

Maine State AGbd_fb1273ad520c4d492026-04-24 · +15dCandidate
Texas State AGbd_1ed8f8b32923e37d2026-04-27 · +18dVerified by operator
Maryland State AGbd_6c61d54a8c64be662025-11-13 · +147dVerified by operator
Massachusetts State AGbd_5500a70c17b28aca2025-01-25 · +439dVerified by operator
Massachusetts State AGbd_571c3d6360691c0e2025-01-25 · +439dVerified by operator
Nebraska State AGbd_00305438b8930f502025-01-24 · +440dVerified by operator

Showing first 10 of 18 linked disclosures.

Name: Texas Tech University Health Sciences Center
norm: texas tech university health sciences center
Domain: ttuhsc.edu

Name: Texas Tech University Health Sciences Center
norm: texas tech university health sciences center
Domain: ttuhsc.edu
Industry: Educationllm

Discovered: Sep 17, 2024
Breach occurred: Sep 17, 2024 – Sep 29, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 25, 2024
Affected individuals: 511state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified federal law enforcementNotified applicable regulators

During the incident: Took steps to ensure the security of the TTUHSC network
Began an investigation with the assistance of third-party specialists
Conducted a detailed review of the systems that were involved
Notified federal law enforcement and applicable regulators
Provided access to complimentary credit monitoring services for twelve (12) months, through IDX
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implementing additional safeguards to enhance system protection and monitoring
Reviewed relevant policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(569 days from discovery to filing)
Compliance flags: WA AG >90dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Nebraska State AGJan 24 · first

Massachusetts State AG+1d

Maryland State AG+293d

Washington State AG+440d · this page

Vermont State AG+455d

New Hampshire State AG+455d

Oregon State AG+455d

California State AG+455d

Maine State AG+455d

Texas State AG+458d

Pattern: first filing Jan 24 (NE), last Apr 27 (TX) — a 458-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 18 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM23805.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 9, 2026
Raw hash: b79570532f657db37e573738d3655ad48969dc4140a7f41a9483a690afc7d711

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityTexas Tech University Health Sciences Center

Victim entityTexas Tech University Health Sciences Center

Incidentdiscovered Sep 17, 2024

Stated responseTook steps to ensure the security of the TTUHSC network

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com