HackingEducationEducationVulnerability ExploitCLOPData ExfiltratedData PublishedTargetedSupply Chain (3P Vendor)Government IDIdentity (basic)Financial accountPIIHighContained

University System of Georgia

bd_bb40387f4a8f9615 · schema v1 · pii pii-v1

Severity

High

Discovered

May 31, 2023

Filed

Mar 29, 2024

To disclose

43 weeks

Affected

1,000state residents only

Linked

8 records

Confidence

69%

Full breach record for University System of Georgia →

University System of Georgia notified Washington AG of a data breach involving MOVEit software vulnerability exploited by CLOP group. Incident occurred May 28, 2023, discovered May 31, 2023. Affected ~1,000 WA residents with SSN, DOB, bank info, tax docs. USG blocked software, updated system, offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d43 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 43 weeks / 303 days

May 28, 2023

Begins

May 31, 2023

Discovered

Mar 29, 2024

Filed

This filing is one of 8 records about the same incident.View merged incident

A leak claim by cl0p about this victim was first seen 266 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_72e2f544722c205d2023-07-07 · +265dVerified by operator

Regulatory filings (6) · sorted by filing gap

California State AGCL0Pbd_3c4f63a7a68d76022024-03-28 · +1dVerified by operator
Oregon State AGbd_a72e0f79e01a59632024-03-28 · +1dVerified by operator
Vermont State AGCL0Pbd_a050588dda8888622024-04-01 · +3dVerified by operator
South Carolina State AGCLOPbd_ff8f8d46c4b554352024-04-01 · +3dVerified by operator

Show 2 more filings ↓up to 39d gap

Indiana State AGbd_bda820409fadae882024-04-19 · +21dVerified by operator
Maine State AGbd_a69a31c89d88dc892024-05-07 · +39dVerified by operator

Name: University System of Georgia
norm: university system of georgia
Domain: regents.usg.edu

Name: University System of Georgia
norm: university system of georgia
Domain: regents.usg.edu
Industry: Educationllm

Discovered: May 31, 2023
Breach occurred: May 28, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 7, 2024
Affected individuals: 1,000state-resident count only
Data types: Government IDIdentity (basic)Financial accountPII
Data elements: NameSocial Security numberFinancial account numberDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Misconfiguration· CLOP
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: CLOPExternalFinancial
Regulator citations: Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) have determined that data was acquired
Initial access: exploit_public_facing

During the incident: MOVEit Transfer software operating at USG was immediately blocked upon detection of the breach
Fully updated and secured in accordance with guidance from Progress Software and CISA
Began a lengthy investigation to determine which individuals may have been impacted
Supplied notification of this incident to the major consumer reporting agencies
Offered identity theft protection services to all individuals
Offering complimentary access to Experian IdentityWorks
Changes made: Fully updated and secured in accordance with guidance from Progress Software and CISA
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 43 weeks(303 days from discovery to filing)
Compliance flags: WA AG >90dLeak >180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGMar 28 · first

Oregon State AGMar 28 · first

Washington State AG+1d · this page

Vermont State AG+4d

South Carolina State AG+4d

Indiana State AG+22d

Maine State AG+40d

Pattern: first filing Mar 28 (CA), last May 7 (ME) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16960.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2024
Raw hash: cce596d6c2aeea6abf4c92c756eb996e4bfbfc7c2936287f430cc4287fb51622

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityUniversity System of Georgia

Victim entityUniversity System of Georgia

Incidentdiscovered May 31, 2023

Stated responseMOVEit Transfer software operating at USG was immediately blocked upon detection of the breach

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com