HackingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
New York University
bd_92f7aa46daf295c8 · schema v1 · pii pii-v1
Full breach record for New York University →New York University reported unauthorized access to its IT network between October 20, 2024, and March 21, 2025. The incident was discovered on March 22, 2025. An unauthorized actor exfiltrated files containing names and Social Security numbers of affected individuals. NYU secured its network, launched an investigation, and is offering one year of complimentary identity monitoring services to affected California residents.
California clockDiscovered Mar 22, 2025 → Notified Mar 22, 20250d ✓ CA 60-day OK11 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_05f8e689f3bd918fWashington State AGfiled 2025-06-09Candidate
- bd_ab260bd3e82b4dd2Oregon State AGfiled 2025-06-09Verified
- bd_b0c57e55c6e303e4Texas State AGfiled 2025-06-10(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-603791
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 9, 2025
- Raw hash
- 7e16aef9f3c5db45e3214b1572c1c17ce79d9ece99aa3bdd3d66b842bfd010ba
Reporting entity
- Name
- New York Universitynorm: new york university
Victim entity
- Name
- New York Universitynorm: new york university
Incident
- Discovered
- Mar 22, 2025
- Materiality determined
- —
- Notification sent
- Mar 22, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unknown
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- External
Compliance
- Time to disclose
- 11 weeks(79 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 22, 2025→ Notified: Mar 22, 20250d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.