HackingStolen CredentialsCapture Stored DataMulti-Stage ChainCustomer Data InvolvedData ExfiltratedPIIIDENTITY_BASICLowContained
Rensselaer Polytechnic Institute
bd_bb4e3de0601012b4 · schema v1 · pii pii-v1
Full breach record for Rensselaer Polytechnic Institute →Rensselaer Polytechnic Institute (RPI) notified students that Athletic Trainer System (ATS), a third-party software provider, experienced a cyber incident between Jan 2020 and Jan 2021. An external actor used a 'data miner' tool to collect info from accounts with vulnerable passwords. RPI was notified by ATS in Nov 2023. RPI required password changes and MFA for admin staff and is transitioning to a new system. Student athlete injury info was compromised.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_8d79f05ec7ca65d2Maine State AGfiled 2024-02-02Verified
- bd_1cade7c054a76facMontana State AGfiled 2024-02-01(1d gap)Candidate
- bd_747790e80bfa4e6eIndiana State AGfiled 2024-02-01(1d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/rensselaer-polytechnic-institute-athletic-trainer-system-20240202.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 2, 2024
- Raw hash
- 4ca3196a24fc118184c91c2e5842a69eea560a409a86c056c7f2384b59f71e64
Reporting entity
- Name
- Rensselaer Polytechnic Institutenorm: rensselaer polytechnic institute
Victim entity
- Name
- Rensselaer Polytechnic Institutenorm: rensselaer polytechnic institute
Incident
- Discovered
- Nov 17, 2023
- Materiality determined
- —
- Notification sent
- Feb 1, 2024
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- investigation involving the FBIFBI is prosecuting the perpetrator
- Third party
- via Athletic Trainer System (ATS)
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 11 weeks(77 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.