HackingEducationEducationVulnerability ExploitCL0PData ExfiltratedTargetedSupply Chain (3P Vendor)Government IDIdentity (basic)Financial accountMediumContained

University System of Georgia

bd_a050588dda888862 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2023

Filed

Apr 1, 2024

To disclose

44 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

67%

Full breach record for University System of Georgia →

The University System of Georgia (USG) disclosed a data breach involving its MOVEit Secure File Transfer software, purchased from Progress Software. A vulnerability in the software allowed the cybercriminal group CL0P to access files starting May 28, 2023. USG blocked the software on May 31, 2023, and updated it. Affected data included SSNs, dates of birth, bank account numbers, and tax documents. USG is offering credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday44 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 44 weeks / 306 days

May 28, 2023

Begins

May 31, 2023

Discovered

Apr 1, 2024

Filed

vs. sector median

+37 wks slower

This filing is one of 8 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 268 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_72e2f544722c205d2023-07-07 · +268dVerified by operator

Regulatory filings (6) · sorted by filing gap

South Carolina State AGCLOPbd_ff8f8d46c4b554352024-04-01Verified by operator
Washington State AGCLOPbd_bb40387f4a8f96152024-03-29 · +3dVerified by operator
California State AGCL0Pbd_3c4f63a7a68d76022024-03-28 · +4dVerified by operator
Oregon State AGbd_a72e0f79e01a59632024-03-28 · +4dVerified by operator

Show 2 more filings ↓up to 36d gap

Indiana State AGbd_bda820409fadae882024-04-19 · +18dVerified by operator
Maine State AGbd_a69a31c89d88dc892024-05-07 · +36dVerified by operator

Name: University System of Georgia
norm: university system of georgia
Domain: regents.usg.edu

Name: University System of Georgia
norm: university system of georgia
Domain: regents.usg.edu
Industry: Educationllm

Discovered: May 31, 2023
Breach occurred: May 28, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2024
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain· CL0P
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: CL0PExternalFinancial
Regulator citations: Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) have determined that data was acquired
Initial access: exploit_public_facing

During the incident: MOVEit Transfer software operating at USG was immediately blocked upon detection of the breach
System has been fully updated and secured in accordance with guidance from Progress Software and CISA
Began a lengthy investigation to determine which individuals may have been impacted
Offering complimentary access to Experian IdentityWorks
Changes made: Updated and secured MOVEit Transfer software
Offering complimentary access to Experian IdentityWorks for [TERM] months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(306 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGMar 28 · first

Oregon State AGMar 28 · first

Washington State AG+1d

South Carolina State AG+4d

Vermont State AG+4d · this page

Indiana State AG+22d

Maine State AG+40d

Pattern: first filing Mar 28 (CA), last May 7 (ME) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-04-01-university-system-georgia-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 1, 2024
Raw hash: 6e13a3aee67a8e722f16e2425b27887f43e527e4ec29b20b5c5274d179fac81d

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityUniversity System of Georgia

Victim entityUniversity System of Georgia

Incidentdiscovered May 31, 2023

Stated responseMOVEit Transfer software operating at USG was immediately blocked upon detection of the breach

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov