MalwareEducationEducationRansomwareData EncryptedTargetedIdentity (basic)LowContained

Oregon Institute of Technology

bd_d16cb37ff58e75cc · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 25, 2018

Filed

Apr 18, 2019

To disclose

25 weeks

Affected

4state residents only

Linked

5 filings

Confidence

64%

Full breach record for Oregon Institute of Technology →

Oregon Institute of Technology notified affected individuals of a data breach where unauthorized access occurred between Oct 19-23, 2018. Systems were infected with a virus. Personal info (name, address) was present on affected systems. No evidence of misuse found. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 25 weeks / 175 days

Oct 19, 2018

Begins

Oct 25, 2018

Discovered

Apr 18, 2019

Filed

vs. sector median

+16 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_27acccd7a5bc0e422019-04-18Candidate
Massachusetts State AGbd_c45783373900bd8f2019-04-18Verified
Oregon State AGbd_dc327516f683d50a2019-04-19 · +1dCandidate
New Hampshire State AGbd_3d873a9544db0c012019-04-22 · +4dVerified

Name: Oregon Institute of Technology
norm: oregon institute of

Name: Oregon Institute of Technology
norm: oregon institute of
Industry: Educationllm

Discovered: Oct 25, 2018
Breach occurred: Oct 19, 2018 – Oct 23, 2018
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 19, 2019
Affected individuals: 4state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External

During the incident: Began an internal investigation into the activity
Working with third-party forensic investigators to confirm the nature and scope of this incident
Reviewing our security policies and procedures and reassessing our technical, administrative, and physical safeguards to identify and implement further security enhancements
Conducting additional employee training on data privacy and security
Offering you access to one year of credit monitoring and identity theft restoration services through Kroll at no cost to you
Changes made: Reviewing our security policies and procedures and reassessing our technical, administrative, and physical safeguards to identify and implement further security enhancements
Conducting additional employee training on data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(175 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Oregon State AGApr 18 · first

Massachusetts State AGApr 18 · first

Montana State AGApr 18 · first · this page

Oregon State AG+1d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-MT-Notice-of-Data-Event-4.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 18, 2019
Raw hash: 0775c862de3129eb52f1b7bf92d452c7715ea041ce2292924a8253871982a3a1

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityOregon Institute of Technology

Victim entityOregon Institute of Technology

Incidentdiscovered Oct 25, 2018

Stated responseBegan an internal investigation into the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov