AccidentalFinancial ServicesEducationFinanceMisdeliveryCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountMediumResolved

Brazos Higher Education Service Corporation, Inc.

bd_b3a39dfd4a574d77 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 27, 2017

Filed

Dec 21, 2017

To disclose

24 days

Affected · nationwide

5002 in this filing

Confidence

65%

Full breach record for Brazos Higher Education Service Corporation, Inc. →

Brazos Higher Education Service Corporation, Inc. notified the NH AG of an inadvertent data disclosure involving a third-party service provider. Between 2016 and Nov 2017, borrower PII (names, SSNs, loan data) was mistakenly included in transmissions to the provider and subsequently sent to unintended recipients via email and mail. ~500 individuals affected (2 in NH). Brazos engaged Experian for identity protection and enhanced redaction controls.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 696 days

discovery → filing · 24 days

Jan 1, 2016

Begins

Nov 27, 2017

Discovered

Dec 21, 2017

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed500 affectedView incident

Name: Brazos Higher Education Service Corporation, Inc.
norm: brazos higher education service

Name: Brazos Higher Education Service Corporation, Inc.
norm: brazos higher education service
Industry: Financial ServicesllmEducationllm

Discovered: Nov 27, 2017
Breach occurred: Jan 1, 2016 – Nov 27, 2017
Undetected for: 696 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2017
Affected individuals: 500state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1566.002 Spearphishing LinkT1074 Data Staged
Threat actor: Partner
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection and Antitrust Bureau

During the incident: Engaged Experian to provide identity theft protection services
Changed redaction procedures including adding additional controls
Implemented better technologies to assist in the redaction of records
Third party service provider increasing training for employees
Limiting number and level of people who have access to borrower level documents
Recalling all documents sent to the third party service provider to date
Requiring destruction of recalled documents
Increasing review of documents being sent for borrowers placed at the third party service provider
Changes made: Changed redaction procedures including adding additional controls
Implemented better technologies to assist in the redaction of records
Third party service provider increasing training for employees
Limiting number and level of people who have access to borrower level documents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/brazos-higher-education-20171221.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 21, 2017
Raw hash: 0918e04459f36a60cd34f50fa36dd1fc8d99ee48e8f9b4abe69e8b1825d024a1

Reporting entityBrazos Higher Education Service Corporation, Inc.

Victim entityBrazos Higher Education Service Corporation, Inc.

Incidentdiscovered Nov 27, 2017

Stated responseEngaged Experian to provide identity theft protection services

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov