AccidentalEducationEducationMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

College of the Holy Cross

bd_cd4f00433d724ad6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 18, 2017

To disclose

—

Affected · nationwide

281 in this filing

Linked

2 filings

Confidence

66%

Full breach record for College of the Holy Cross →3 incidents on file

College of the Holy Cross notified the NH Attorney General that on September 22, 2017, an employee accidentally cross-mailed promissory notes containing names, Social Security numbers, and potentially driver's license numbers to up to 28 alumni (1 NH resident). The incident was caused by mis-stuffing of envelopes. The College sent notifications, offered identity theft protection, and adjusted mailing processes to prevent recurrence.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 22, 2017

Begins

Oct 18, 2017

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_5f4443e971ed837b2017-10-19 · +1dVerified

Name: College of the Holy Cross
norm: college of the holy cross
Domain: holycross.edu

Name: College of the Holy Cross
norm: college of the holy cross
Domain: holycross.edu
Industry: Educationllm

Discovered: —
Breach occurred: Sep 22, 2017
Materiality determined: —
Notification sent: Oct 18, 2017
Affected individuals: 28state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
Threat actor: Internal
Regulator citations: Notified New Hampshire Attorney General

During the incident: Sent notification letters to the potentially affected individuals
Offered one year of complimentary identity theft protection services
Telephoned and/or emailed those known for certain to be affected
Changes made: Bursar's Office will no longer be mailing paid-in-full promissory notes to alumni
Will have a third party mail a paid-in-full notice to former students
Undergoing an evaluation of business processes to identify if any further changes are required
Adjusting processes and training to minimize the chances of this happening in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 18 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/college-holy-cross-20171018.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 18, 2017
Raw hash: 3db3a8d684e0587d1724be30171759f6515a478e271407fe1a0465621d76019e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCollege of the Holy Cross

Victim entityCollege of the Holy Cross

IncidentUnknown

Stated responseSent notification letters to the potentially affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov