HackingEducationEducationStolen CredentialsCapture Stored DataCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Virginia Union University

bd_96b9f5e12ee47717 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 13, 2023

Filed

May 6, 2024

To disclose

15 months

Affected

20state residents only

Linked

8 records

Confidence

67%

Full breach record for Virginia Union University →3 incidents on file

Virginia Union University notified the NH Attorney General of unauthorized network access discovered on Feb 13, 2023. Personal info (names, SSNs, DOBs) of 20 NH residents was accessed. Notification sent May 1, 2024, offering credit monitoring. Investigation concluded April 1, 2024.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d15 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 15 months / 448 days

Feb 13, 2023

Discovered

May 6, 2024

Filed

This filing is one of 8 records about the same incident.View merged incident

A leak claim by lockbit_3 about this victim was first seen 440 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_25927e13677b544f2023-02-21 · +439dVerified by operator

Regulatory filings (6) · sorted by filing gap

California State AGbd_1dd9c37ba2a258a32024-05-01 · +5dCandidate
Massachusetts State AGbd_720bb632b418dd902024-05-01 · +5dVerified
Illinois State AGbd_826d37e056a9d70d2024-05-01 · +5dVerified
Montana State AGbd_8d7a0194509940d22024-05-01 · +5dVerified by operator

Show 2 more filings ↓up to 5d gap

Indiana State AGbd_a59099b99e36561c2024-05-01 · +5dVerified by operator
Delaware State AGbd_b8c00e40674155fa2024-05-01 · +5dVerified by operator

Name: UNIVERSITY OF VIRGINIA COMMUNITY CREDIT UNION, INC.
norm: university of virginia community credit union

Name: Virginia Union University
norm: virginia union university
Domain: vuu.edu
Industry: Educationllm

Discovered: Feb 13, 2023
Materiality determined: —
Notification sent: May 1, 2024
Affected individuals: 20state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Contained the threat
Engaged external cybersecurity professionals to conduct an investigation
Provided notification to affected residents
Offered complimentary credit monitoring services
Changes made: Evaluate and improve administrative and technical safeguards
Training employees on best practices related to cybersecurity, policies, procedures, and protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(448 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGMay 1 · first

Massachusetts State AGMay 1 · first

Illinois State AGMay 1 · first

Montana State AGMay 1 · first

Indiana State AGMay 1 · first

Delaware State AGMay 1 · first

New Hampshire State AG+5d · this page

Pattern: first filing May 1 (CA), last May 6 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/virginia-union-university-20240506.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 6, 2024
Raw hash: a823d73ab27ffcb83135291b80f450b6050a3522ac331daa8030034ae008f87d

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityUNIVERSITY OF VIRGINIA COMMUNITY CREDIT UNION, INC.

Victim entityVirginia Union University

Incidentdiscovered Feb 13, 2023

Stated responseContained the threat

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov