HackingEducationEducationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

OBERLIN COLLEGE

bd_ceb5a53b367adc8a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 5, 2019

Filed

Jul 12, 2019

To disclose

18 weeks

Affected

12state residents only

Linked

3 filings

Confidence

66%

Full breach record for OBERLIN COLLEGE →

Oberlin College notified the NH Attorney General that an unauthorized actor gained access to its admissions software on March 5, 2019. The breach affected 12 New Hampshire residents, exposing names and Social Security numbers. Oberlin engaged forensic investigators, notified the FBI, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 weeks / 129 days

Mar 5, 2019

Begins

Mar 5, 2019

Discovered

Jul 12, 2019

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_00561e498f866a022019-07-12Verified
Montana State AGbd_0e8c183451004c822019-07-12Candidate

Name: Oberlin College
norm: oberlin college

Name: OBERLIN COLLEGE
norm: oberlin college
Industry: Educationllm

Discovered: Mar 5, 2019
Breach occurred: Mar 5, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 12, 2019
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney GeneralProvided information to the FBI

During the incident: Immediately took steps to secure the software
Launched an in-depth investigation with the assistance of a third-party forensic investigation firm
Provided information to the FBI regarding this incident
Provided potentially affected individuals access to twelve (12) months of credit monitoring and identity restoration services through TransUnion
Changes made: Reviewed its existing policies and procedures
Implemented additional safeguards to further secure the information in its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(129 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJul 12 · first

Montana State AGJul 12 · first

New Hampshire State AGJul 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/oberlin-college-20190712.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 12, 2019
Raw hash: bf9f6b104a82d50a226a2445e71aacd384d62756b7611abdeab2762c50ccdfdb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityOberlin College

Victim entityOBERLIN COLLEGE

Incidentdiscovered Mar 5, 2019

Stated responseImmediately took steps to secure the software

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov