AccidentalEducationEducationMisconfigurationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Bucknell University

bd_9f1314ded6e71e52 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 31, 2016

Filed

Jun 3, 2016

To disclose

9 weeks

Affected

22state residents only

Linked

2 filings

Confidence

67%

Full breach record for Bucknell University →3 incidents on file

Bucknell University notified the NH AG of a data event involving sensitive data stored in an internal document application (Netspace). Sensitive data was identified in March/April 2016. No evidence of improper access was found, but unauthorized access could not be ruled out. 22 NH residents notified. Remediation included forensic investigation, policy review, staff education, and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 64 days

Mar 31, 2016

Discovered

Jun 3, 2016

Filed

vs. sector median

1 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_5ac1912ddd2908eb2016-06-03Verified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Bucknell University
norm: bucknell university
Industry: Educationllm

Discovered: Mar 31, 2016
Materiality determined: —
Notification sent: Jun 3, 2016
Affected individuals: 22state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Notified New Hampshire Attorney General

During the incident: The information was immediately moved to a secure location
Bucknell hired nationally recognized forensic consultants to investigate
Providing potentially affected individuals with one year of free credit monitoring and identify theft assistance through Experian
Changes made: Reviewing its policies and procedures relating to data privacy
Taking steps to further educate its staff on appropriate storage of sensitive information
Will continue to deploy its scanning tool to ensure no information is placed on non-private Netspace folders
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJun 3 · first

New Hampshire State AGJun 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bucknell-university-20160603.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2016
Raw hash: 0b6b9404a0ad7a49195dba27d95c71021310b7e267c2e2a9c07cb44558221e8c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityBucknell University

Incidentdiscovered Mar 31, 2016

Stated responseThe information was immediately moved to a secure location

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov