MalwareEducationEducationDelayed DiscoveryCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEmploymentEducationPIIHighContained

University of Connecticut

bd_9ebd377ce6403ef7 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 9, 2015

Filed

Jun 14, 2016

To disclose

15 months

Affected · nationwide

34,382375 in this filing

Linked

4 filings

Confidence

65%

Full breach record for University of Connecticut →3 incidents on file

University of Connecticut notified New Hampshire AG of a malware compromise in the School of Engineering servers. Penetration began Sept 2013; detected March 2015. 34,382 individuals impacted (375 NH residents). Data included names, SSNs, ITINs, employment, and academic info. No evidence of data access confirmed, but insufficient to rule out. Notifications sent May 2016 with 1-year identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 554 days

discovery → filing · 15 months / 463 days

Sep 1, 2013

Begins

Mar 9, 2015

Discovered

Jun 14, 2016

Filed

vs. sector median

+59 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_73f9d306ec848b0e2016-06-14Candidate
Montana State AGbd_863d0118c33161912016-06-14Verified
Massachusetts State AGbd_13d31386cf953e132016-06-20 · +6dVerified

Name: University of Connecticut
norm: university of connecticut
Domain: uconn.edu
Industry: education

Name: University of Connecticut
norm: university of connecticut
Domain: uconn.edu
Industry: education
Industry: Educationllm

Discovered: Mar 9, 2015
Breach occurred: Sep 1, 2013
Undetected for: 554 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 31, 2016
Affected individuals: 34,382state + nationwide
Data types: Identity (basic)Government IDEmploymentEducationPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Office of the Attorney General for the State of ConnecticutNotified New Hampshire Attorney General

During the incident: Partnered with appropriate law enforcement units
Partnered with the Privacy Department of the Office of the Attorney General for the State of Connecticut
Provided notification of the incident to potentially impacted individuals and entities
Secured the services of AI/Clear ID for identity theft protection services
Provided written notification via first class mail to all of the impacted individuals
Offered one year of identity theft protection services at the University's expense
Changes made: Taking steps to prevent a similar occurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(463 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGJun 14 · first

Montana State AGJun 14 · first

New Hampshire State AGJun 14 · first · this page

Massachusetts State AG+6d

Pattern: first filing Jun 14 (CA), last Jun 20 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/university-connecticut-20160614.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2016
Raw hash: eeb7a84f3223f3bcbd44d58d9c9062011f07ea1c827cc9f40cb336c01bcd7f4b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityUniversity of Connecticut

Victim entityUniversity of Connecticut

Incidentdiscovered Mar 9, 2015

Stated responsePartnered with appropriate law enforcement units

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov