HackingHealthcareEducationHealthcareVulnerability ExploitCapture Stored DataData ExfiltratedTargetedGovernment IDPIIMediumActive

Boston University Framingham Heart Study

bd_903b27ce593af33a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 8, 2024

Filed

Dec 23, 2024

To disclose

15 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Boston University Framingham Heart Study →

Framingham Heart Study at Boston University and NHLBI reported that on September 8, 2024, they became aware of unusual activity on a server system. Cyber-attackers accessed the server and downloaded files containing unencrypted personal information, including Social Security numbers. The server was isolated and patched. Law enforcement was notified, and affected individuals are offered credit monitoring via Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 106 days

Sep 8, 2024

Discovered

Dec 23, 2024

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_96527cc51218eb562024-12-19 · +4dCandidate
Massachusetts State AGbd_196455a705fd46102024-12-17 · +6dVerified

Name: Boston University Framingham Heart Study
norm: boston university framingham heart study

Name: Boston University Framingham Heart Study
norm: boston university framingham heart study
Industry: HealthcarellmEducationllm

Discovered: Sep 8, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the appropriate law enforcement agencies
Initial access: exploit_public_facing

During the incident: Isolated the server to prevent further unauthorized activity
Applied patches to the protected server environment to address the vulnerability
Notified the appropriate law enforcement agencies
Hosting an online meeting to discuss concerns
Changes made: Applied patches to the protected server environment to address the vulnerability
Making available a free membership in a credit monitoring service, Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(106 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 17 · first

Maine State AG+2d

New Hampshire State AG+6d · this page

Pattern: first filing Dec 17 (MA), last Dec 23 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/framingham-heart-study-boston-university-20241223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2024
Raw hash: e518345c7f7fb6f4e3e1b1e380e6a7dd28fd2a6a7ca893566eb0fc5050aa2c34

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBoston University Framingham Heart Study

Victim entityBoston University Framingham Heart Study

Incidentdiscovered Sep 8, 2024

Stated responseIsolated the server to prevent further unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov