HackingEducationEducationStolen CredentialsCapture Stored DataMulti-Stage ChainCustomer Data InvolvedData ExfiltratedPIIIdentity (basic)LowContained

Rensselaer Polytechnic Institute

bd_bb4e3de0601012b4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 17, 2023

Filed

Feb 2, 2024

To disclose

11 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Rensselaer Polytechnic Institute →2 incidents on file

Rensselaer Polytechnic Institute (RPI) notified students that Athletic Trainer System (ATS), a third-party software provider, experienced a cyber incident between Jan 2020 and Jan 2021. An external actor used a 'data miner' tool to collect info from accounts with vulnerable passwords. RPI was notified by ATS in Nov 2023. RPI required password changes and MFA for admin staff and is transitioning to a new system. Student athlete injury info was compromised.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1416 days

discovery → filing · 11 weeks / 77 days

Jan 1, 2020

Begins

Nov 17, 2023

Discovered

Feb 2, 2024

Filed

vs. sector median

+2 wks slower

This filing is one of 4 about the same incident.View merged incident

Part of Athletic Trainer System supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_8d79f05ec7ca65d22024-02-02Verified
Montana State AGbd_1cade7c054a76fac2024-02-01 · +1dCandidate
Indiana State AGbd_747790e80bfa4e6e2024-02-01 · +1dVerified

Name: Rensselaer Polytechnic Institute
norm: rensselaer polytechnic institute

Name: Rensselaer Polytechnic Institute
norm: rensselaer polytechnic institute
Industry: Educationllm

Discovered: Nov 17, 2023
Breach occurred: Jan 1, 2020 – Jan 1, 2021
Undetected for: 1,416 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2024
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: investigation involving the FBIFBI is prosecuting the perpetrator
Third party: via Athletic Trainer System (ATS)
Initial access: valid_credentials

During the incident: All staff who have administrative access to this software have been required to change their passwords
Use dual factor authentication for access
Ensure compliance with RPI’s password complexity standards
RPI is transitioning to a new system called PyraMed and will no longer be using the ATS software
Providing you with information on how you can implement fraud alerts and credit freezes with credit agencies and obtain free credit monitoring services
Changes made: All staff who have administrative access to this software have been required to change their passwords
Use dual factor authentication for access
Ensure compliance with RPI’s password complexity standards
RPI is transitioning to a new system called PyraMed and will no longer be using the ATS software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGFeb 1 · first

Indiana State AGFeb 1 · first

Maine State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rensselaer-polytechnic-institute-athletic-trainer-system-20240202.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 2, 2024
Raw hash: 4ca3196a24fc118184c91c2e5842a69eea560a409a86c056c7f2384b59f71e64

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRensselaer Polytechnic Institute

Victim entityRensselaer Polytechnic Institute

Incidentdiscovered Nov 17, 2023

Stated responseAll staff who have administrative access to this software have been required to change their passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov