PhysicalEducationEducationTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Columbia University

bd_8fc6c3a608fadccb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 18, 2010

Filed

Feb 1, 2010

To disclose

14 days

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Columbia University →7 incidents on file

Columbia University reported the theft of three password-protected laptops from an administrative office on January 18, 2010. The devices contained names and Social Security numbers of students, alumni, and employees. One New Hampshire resident was affected. The university notified affected individuals on January 29, 2010, and offered two years of complimentary credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 days

Jan 18, 2010

Begins

Jan 18, 2010

Discovered

Feb 1, 2010

Filed

vs. sector median

7 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_efa1375f8ffbef022010-02-01Verified

Name: Columbia University
norm: columbia university

Name: Columbia University
norm: columbia university
Industry: Educationllm

Discovered: Jan 18, 2010
Breach occurred: Jan 18, 2010
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 29, 2010
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney General

During the incident: Alerted the New York City Police Department
Notified affected individuals by regular mail
Offered a two-year subscription to a credit monitoring system at no cost
Recommended activating a fraud alert with the major credit bureaus
Changes made: Strengthened the physical security of the office
Increasing laptop security through the installation of high level encryption programs
Taking a more aggressive approach to scanning computer equipment for potential security threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGFeb 1 · first

New Hampshire State AGFeb 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/columbia-university-20100201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 1, 2010
Raw hash: 93456ec327a4072b0f70a2aa2e7943d9be65a5c56b915aeb2bbd1cc5c67b0e52

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityColumbia University

Victim entityColumbia University

Incidentdiscovered Jan 18, 2010

Stated responseAlerted the New York City Police Department

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov