HackingEducationEducationCustomer Data InvolvedEmployee Data InvolvedPIIPHIPCICredentialsFinancialIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)AuthenticationBiometricEducationMinorEmploymentCriticalContained

East Valley Institute of Technology

bd_8f3cb49e2c503973 · schema v1 · pii pii-v1

Severity

Critical

Discovered

—

Filed

Aug 13, 2024

To disclose

—

Affected

208,717

Linked

3 filings

Confidence

66%

On January 9, 2024, East Valley Institute of Technology (EVIT) experienced a cyber-incident involving unauthorized access to its network, potentially affecting 208,717 individuals. Compromised data included PII, PHI, financial records, credentials, and biometric data. EVIT contained the threat by locking down VPN access, deploying EDR, changing passwords, and rebuilding servers. The organization engaged third-party security experts and offered identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Jan 9, 2024

Begins

Aug 13, 2024

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_3832ccf14d82ffef2024-01-19 · +206dVerified by operator

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGLockBitbd_d1a1fc59fd798bb82024-08-13Verified

Name: East Valley Institute of Technology
norm: east valley institute of technology
Domain: evit.edu

Name: East Valley Institute of Technology
norm: east valley institute of technology
Domain: evit.edu
Industry: Educationllm

Discovered: —
Breach occurred: Jan 9, 2024
Materiality determined: —
Notification sent: Aug 13, 2024
Affected individuals: 208,717nationwide
Data types: PIIPHIPCICredentialsFinancialIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)AuthenticationBiometricEducationMinorEmployment
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to appropriate authoritiesReported the incident to the three largest nationwide consumer reporting agencies

During the incident: Contacted the appropriate authorities
Locked down VPN Access
Deployed EDR software
Implemented 24x7 monitoring for the incident
Revoked privileged user access
Changed all service account passwords
Changed all user passwords
Revoked domain trust
Performed domain cleanup
Rebuilt or replaced nineteen virtual servers
Engaged a third party specializing in network security
Provided email notification to all current and former students, staff, faculty, and parents
Posted alternative website notice for impacted individuals
Sent individual notice to anyone identified as potentially impacted
Reported the incident to the three largest nationwide consumer reporting agencies
Changes made: Engaged a third party specializing in network security to help add computer security protections and protocols
Hardened network infrastructure
Offered improved protections of sensitive data from unauthorized access
Offered 12 months of CyberScan monitoring through IDX
Offered a $1,000,000 insurance reimbursement policy through IDX
Offered fully managed id theft recovery services through IDX
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGAug 13 · first

Vermont State AGAug 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-08-13-east-valley-institute-technology-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 13, 2024
Raw hash: 8066814ab05790e9143cce9df222bfa1677698ca4a6c9546860180a762d8d2fc

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityEast Valley Institute of Technology

Victim entityEast Valley Institute of Technology

IncidentUnauthorized Access

Stated responseContacted the appropriate authorities

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov