AccidentalEducationEducationMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

DigiPen Institute of Technology

bd_943d7e23527a2ba7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 30, 2018

Filed

May 7, 2018

To disclose

7 days

Affected

1state residents only

Linked

2 filings

Confidence

64%

Full breach record for DigiPen Institute of Technology →2 incidents on file

DigiPen Institute of Technology notified affected individuals on May 7, 2018, that on April 25, 2018, an employee inadvertently emailed a spreadsheet containing students' personal information (names, SSNs, student IDs, programs) to an unauthorized recipient. The error was discovered on April 30, 2018. DigiPen offered 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 7 days

Apr 25, 2018

Begins

Apr 30, 2018

Discovered

May 7, 2018

Filed

vs. sector median

8 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_f0163e3598b3eac32018-05-07Verified

Name: DigiPen Institute of Technology
norm: digipen institute of
Domain: digipen.edu

Name: DigiPen Institute of Technology
norm: digipen institute of
Domain: digipen.edu
Industry: Educationllm

Discovered: Apr 30, 2018
Breach occurred: Apr 25, 2018
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 7, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unknown
MITRE ATT&CK: T1535 Unused/Tracked Access Accounts
Threat actor: Internal

During the incident: Initiated an investigation to determine what happened and what may have been affected
Seeking contact with the unintended email recipient to request that the information be permanently deleted
Implementing additional measures with respect to security, including by reviewing our internal protocols regarding the storage and sharing of personal information
Providing additional user education designed to prevent the recurrence of a similar inadvertent disclosure
Arranged to have AllClear ID protect your identity for 12 months at no cost
Changes made: Reviewing internal protocols regarding the storage and sharing of personal information
Providing additional user education designed to prevent the recurrence of a similar inadvertent disclosure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGMay 7 · first

Montana State AGMay 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/DigiPen.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2018
Raw hash: 12b372caae41c5fc4fd11cd060e8debfe11d8404e23d49bc121bf87a71691f49

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityDigiPen Institute of Technology

Victim entityDigiPen Institute of Technology

Incidentdiscovered Apr 30, 2018

Stated responseInitiated an investigation to determine what happened and what may have been affected

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov