HackingEducationEducationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Virginia Union University

bd_b8c00e40674155fa · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 13, 2023

Filed

May 1, 2024

To disclose

15 months

Affected

Not disclosed

Linked

8 records

Confidence

67%

Full breach record for Virginia Union University →3 incidents on file

Virginia Union University notified Delaware residents of a cybersecurity incident detected on February 13, 2023, involving unauthorized network access. Personal information, including full names and Social Security Numbers, was accessed. The university engaged external forensic investigators, contained the threat, and offered 12 months of complimentary credit monitoring and identity defense services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d15 months discovery → filing

Incident timeline

discovery → filing · 15 months / 443 days

Feb 13, 2023

Discovered

May 1, 2024

Filed

This filing is one of 8 records about the same incident.View merged incident

A leak claim by lockbit_3 about this victim was first seen 435 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_25927e13677b544f2023-02-21 · +434dVerified by operator

Regulatory filings (6) · sorted by filing gap

California State AGbd_1dd9c37ba2a258a32024-05-01Candidate
Massachusetts State AGbd_720bb632b418dd902024-05-01Verified
Illinois State AGbd_826d37e056a9d70d2024-05-01Verified
Montana State AGbd_8d7a0194509940d22024-05-01Verified by operator

Show 2 more filings ↓up to 5d gap

Indiana State AGbd_a59099b99e36561c2024-05-01Verified by operator
New Hampshire State AGbd_96b9f5e12ee477172024-05-06 · +5dVerified by operator

Name: UNIVERSITY OF VIRGINIA COMMUNITY CREDIT UNION, INC.
norm: university of virginia community credit union

Name: Virginia Union University
norm: virginia union university
Domain: vuu.edu
Industry: Educationllm

Discovered: Feb 13, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Contained the threat
Commenced a prompt and thorough investigation with external cybersecurity professionals
Offered a complimentary 12-month membership of CyEx Identity Defense
Changes made: Continually evaluate and modify practices to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(443 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGMay 1 · first

Massachusetts State AGMay 1 · first

Illinois State AGMay 1 · first

Montana State AGMay 1 · first

Indiana State AGMay 1 · first

Delaware State AGMay 1 · first · this page

New Hampshire State AG+5d

Pattern: first filing May 1 (CA), last May 6 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2024/05/VUU-Adult_SSN_Redacted_33531808v1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 1, 2024
Raw hash: d51f6f8eb42b538cc5881903736c5910dd61bcc9ed03ce43219d32f5c9733b1a

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityUNIVERSITY OF VIRGINIA COMMUNITY CREDIT UNION, INC.

Victim entityVirginia Union University

Incidentdiscovered Feb 13, 2023

Stated responseContained the threat

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov