MalwareEducationEducationInfostealerTorpigData ExfiltratedMulti-Stage ChainGovernment IDPIIMediumContained

Tufts University

bd_c03e9b66924a49d8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 18, 2010

Filed

Jun 3, 2010

To disclose

15 weeks

Affected

73state residents only

Confidence

66%

Full breach record for Tufts University →7 incidents on file

Tufts University filed a supplemental notice with the New Hampshire Attorney General regarding a malware incident involving the 'torpig' infostealer. The breach affected 73 New Hampshire residents, exposing Social Security numbers. The university engaged forensic investigators, isolated affected systems, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 15 weeks / 105 days

Feb 17, 2010

Begins

Feb 18, 2010

Discovered

Jun 3, 2010

Filed

vs. sector median

+8 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed73 affectedView incident

Name: Tufts University
norm: tufts university
Domain: tufts.edu

Name: Tufts University
norm: tufts university
Domain: tufts.edu
Industry: Educationllm

Discovered: Feb 18, 2010
Breach occurred: Feb 17, 2010 – Apr 1, 2010
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: May 24, 2010
Affected individuals: 73state-resident count only
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1071 Application Layer ProtocolT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: drive_by_compromise

During the incident: Arranged for an internal forensic review of the hard drives
Isolated the computers in question
Engaged an outside contractor, cmd Labs of Baltimore, MD, to assist in the analysis
Sent notice to affected individuals
Offered one year of credit monitoring from Experian
Changes made: Updated anti-virus definitions
Deployed security patches from software vendors
Identifying where personal information is being stored
Securely destroying information that is no longer needed
Reviewing the security safeguards in place for personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(105 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tufts-university-20100603.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2010
Raw hash: 95c5d93ac386b374535042564ee09a9ba401a41b1c2ef8f79f96d5aa8a85ad28

Reporting entityTufts University

Victim entityTufts University

Incidentdiscovered Feb 18, 2010

Stated responseArranged for an internal forensic review of the hard drives

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov