MalwareEducationEducationRansomwareData ExfiltratedRansom DemandedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Columbia College of Chicago

bd_b2f2e5126ba2b5e6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 30, 2020

Filed

Jul 15, 2020

To disclose

7 weeks

Affected

1state residents only

Linked

7 records

Confidence

66%

Full breach record for Columbia College of Chicago →2 incidents on file

Columbia College Chicago experienced a ransomware attack on May 30, 2020. The threat actor accessed and exfiltrated student and employee personal information, including names and Social Security numbers. One New Hampshire resident was affected. The college engaged forensic investigators, implemented remote monitoring tools, multifactor authentication, and removed local administrative rights. Affected individuals were offered credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d7 weeks discovery → filing

Incident timeline

discovery → filing · 7 weeks / 46 days

May 30, 2020

Begins

May 30, 2020

Discovered

Jul 15, 2020

Filed

This filing is one of 7 records about the same incident.View merged incident

A leak claim by netwalker about this victim was first seen 42 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitenetwalkerbd_1dda001098a673f82020-06-03 · +42dCandidate

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_3ef7d979c74a98922020-07-15Verified
Montana State AGbd_6c1e0586edfbf6072020-07-15Verified
Indiana State AGbd_82e118f1ea9b222b2020-07-15Verified by operator
New Hampshire State AGbd_7f8012c92f50029b2020-07-29 · +14dCandidate

Show 1 more filing ↓up to 196d gap

Illinois State AGbd_a7c6c1477885762d2020-01-01 · +196dVerified by operator

Name: Columbia College of Chicago
norm: columbia college of chicago

Name: Columbia College of Chicago
norm: columbia college of chicago
Industry: Educationllm

Discovered: May 30, 2020
Breach occurred: May 30, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 15, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Engaged a third-party computer forensics firm to conduct a thorough investigation into the ransomware incident
Began engaging in negotiations with the unknown/unauthorized threat actors
Changes made: Implementing a remote monitoring tool on all Columbia owned devices to prevent the execution of any malware or ransomware on those devices
Implementing multifactor authentication
Removing local administrative rights
Providing affected individuals with credit monitoring and identity theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+196d

Montana State AG+196d

Indiana State AG+196d

New Hampshire State AG+196d · this page

New Hampshire State AG+210d

Pattern: first filing Jan 1 (IL), last Jul 29 (NH) — a 210-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/columbia-college-chicago-20200715.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 15, 2020
Raw hash: bb87cde7ca470654985af628b2613d4180ba32426ec09b27f5b0d4ecba24f84a

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityColumbia College of Chicago

Victim entityColumbia College of Chicago

Incidentdiscovered May 30, 2020

Stated responseEngaged a third-party computer forensics firm to conduct a thorough investigation into the ransomware incident

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov