HackingEducationEducationData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)MediumContained

WENTWORTH INSTITUTE OF TECHNOLOGY, INC.

bd_bd654dd83b38127c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 20, 2010

Filed

Feb 4, 2011

To disclose

7 weeks

Affected

88state residents only

Confidence

66%

Full breach record for WENTWORTH INSTITUTE OF TECHNOLOGY, INC. →3 incidents on file

Wentworth Institute of Technology notified NH AG of unauthorized access to personal info (names, SSNs, DOBs, and some medical data) of 88 NH residents. Data was accessible on a public web server from April 2007 to Dec 2010. Incident discovered Dec 20, 2010. Notifications mailed Jan 14, 2011. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1351 days

discovery → filing · 6 weeks / 45 days

Apr 10, 2007

Begins

Dec 20, 2010

Discovered

Feb 4, 2011

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed88 affectedView incident

Name: WENTWORTH INSTITUTE OF TECHNOLOGY, INC.
norm: wentworth institute of
Domain: wit.edu

Name: WENTWORTH INSTITUTE OF TECHNOLOGY, INC.
norm: wentworth institute of
Domain: wit.edu
Industry: Educationllm

Discovered: Dec 20, 2010
Breach occurred: Apr 10, 2007 – Dec 20, 2010
Undetected for: 1,351 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 14, 2011
Affected individuals: 88state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1074 Data Staged
Threat actor: External
Initial access: exploit_public_facing

During the incident: Removed the data from the web server, and placed it in a secure, quarantined location
Sent requests to Google to have the data removed from cache
Began an internal forensic discovery
Offered credit monitoring services to those affected
Engaged the services of an attorney and a data security consultant
Changes made: Procured Identity Finder tool to find and quarantine personal information
Scanning all public facing servers, local drives, and internal servers
Information Security Committee meets regularly to update policies
Local and network drives will be scanned monthly
Employees will be automatically warned if personal information is being copied to an unsecure location
Contracted an outside auditor to complete penetration testing
Evaluating encryption software for future implementation
Logging of activity on webservers has been activated
Reinforced procedure for reviewing all personal information requests
Established a policy for length of time information is stored on server or in a database
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wentworth-institute-20110204.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 4, 2011
Raw hash: 68ee117e2762c4894608716ab5169e0940ff3b04d2c8c8e2e5706792ad93d957

Reporting entityWENTWORTH INSTITUTE OF TECHNOLOGY, INC.

Victim entityWENTWORTH INSTITUTE OF TECHNOLOGY, INC.

Incidentdiscovered Dec 20, 2010

Stated responseRemoved the data from the web server, and placed it in a secure, quarantined location

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov