HackingEducationEducationStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

Syracuse University

bd_9d537454055110c5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 14, 2022

Filed

Mar 28, 2022

To disclose

6 weeks

Affected

3state residents only

Linked

5 filings

Confidence

65%

Full breach record for Syracuse University →3 incidents on file

Syracuse University notified affected individuals of unauthorized access to two disbursement office email accounts between Nov 11-15, 2021. The incident involved the compromise of names and Social Security numbers. The University secured the accounts, investigated, and offered one year of Experian IdentityWorks protection. Notification was sent March 28, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 95 days

discovery → filing · 6 weeks / 42 days

Nov 11, 2021

Begins

Feb 14, 2022

Discovered

Mar 28, 2022

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_05b34336f4bd933f2022-03-28Verified
Maine State AGbd_9e4a1a41cbf3953b2022-03-28Verified
Massachusetts State AGbd_b112c43d62017a1f2022-03-28Verified
Indiana State AGbd_f2f7171c849e0fb72022-03-28Verified

Name: Syracuse University
norm: syracuse university

Name: Syracuse University
norm: syracuse university
Industry: Educationllm

Discovered: Feb 14, 2022
Breach occurred: Nov 11, 2021 – Nov 15, 2021
Undetected for: 95 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 28, 2022
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email accounts
Launched an investigation
Reviewed the emails and attachments contained in the email accounts
Engaged Experian to offer complimentary one-year membership in Experian’s IdentityWorks
Implemented additional security measures to enhance the security of our email environment
Continuing to train our employees concerning data security
Changes made: Implemented additional security measures to enhance the security of our email environment
Continuing to train our employees concerning data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGMar 28 · first

Maine State AGMar 28 · first

Massachusetts State AGMar 28 · first

Indiana State AGMar 28 · first

Montana State AGMar 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Syracuse-University-Consumer-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2022
Raw hash: ef1ea0ca078864eb2fc7fcfb34acb48f71f635c92776b290db1666a4d3b9d068

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySyracuse University

Victim entitySyracuse University

Incidentdiscovered Feb 14, 2022

Stated responseSecured the email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov