DisclosureLens
HackingEducationEducationVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

The Curators of the University of Missouri

bd_9e9feecb13b05e12 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 9, 2023

Filed

Oct 25, 2023

To disclose

7 weeks

Affected

29state residents only

Linked

6 filings

Confidence

66%
Full breach record for The Curators of the University of Missouri2 incidents on file

The University of Missouri notified the New Hampshire Attorney General on October 25, 2023, of a data breach involving approximately 29 NH residents. The incident stemmed from a zero-day vulnerability in Progress Software's MOVEit Transfer application, disclosed by Progress on May 31, 2023. The University confirmed that personal information of affected individuals was acquired by unauthorized actors. The University engaged third-party experts, notified law enforcement, took the application offline, applied patches, and offered two years of Kroll identity monitoring services. The investigation concluded on September 9, 2023.

Incident timeline

undetected · 101 days
discovery → filing · 7 weeks / 46 days

May 31, 2023

Begins

Sep 9, 2023

Discovered

Oct 25, 2023

Filed

vs. sector median

on median

This filing is one of 6 about the same incident.View merged incident
Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Show 1 more filingup to 5d gap

Filing propagation · 6 filings · 6 states

View merged incident ↗
Vermont State AGOct 20 · first
Indiana State AGOct 20 · first
New Hampshire State AG+5d · this page

Pattern: first filing Oct 20 (VT), last Oct 25 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.