Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedTargetedPIIIdentity (basic)LowContained

Saint Louis University

bd_c9200ba00f50e4ba · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 2, 2023

Filed

Oct 19, 2023

To disclose

33 weeks

Affected

12state residents only

Confidence

66%

Full breach record for Saint Louis University →4 incidents on file

Saint Louis University notified Montana residents of a data breach involving unauthorized access to email accounts containing personal information. The incident was discovered on March 2, 2023, following suspicious activity. Forensic investigators confirmed access to specific accounts and limited documents on SharePoint/OneDrive. Affected data likely included names and other PII. No evidence of fraud was found at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 33 weeks / 231 days

Mar 2, 2023

Discovered

Oct 19, 2023

Filed

vs. sector median

+26 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed12 affectedView incident

Name: Saint Louis University
norm: saint louis university
Domain: slu.edu

Name: Saint Louis University
norm: saint louis university
Domain: slu.edu
Industry: Educationllm

Discovered: Mar 2, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 12state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Engaged a forensic security firm to investigate the security of our email environment and computer systems
Began an internal investigation
Engaged a dedicated call center to address questions
Changes made: Reviewing technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-776.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 19, 2023
Raw hash: 705ff0b0d113d4a85a344c339be7b4c40926bacb9166917d53df2ee8d09a58c8

Reporting entitySaint Louis University

Victim entitySaint Louis University

Incidentdiscovered Mar 2, 2023

Stated responseEngaged a forensic security firm to investigate the security of our email environment and computer systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov