HackingEducationEducationCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumActive

Michigan State University

bd_d21d343df8350715 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 13, 2016

Filed

Nov 22, 2016

To disclose

9 days

Affected

463state residents only

Linked

7 filings

Confidence

66%

Full breach record for Michigan State University →4 incidents on file

Michigan State University notified the NH Attorney General of a cyberattack on Nov 13, 2016, involving unauthorized access to a database containing PII of employees and students. 463 NH residents were affected. Data included names, SSNs, and ID numbers. The database was taken offline, law enforcement was engaged, and credit monitoring was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 days

Nov 13, 2016

Discovered

Nov 22, 2016

Filed

vs. sector median

7 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_238b0815544e28c62016-11-21 · +1dVerified
Washington State AGbd_6a26001a1e6948922016-11-18 · +4dCandidate
South Carolina State AGbd_df6b2bd59bf55bdf2016-11-28 · +6dVerified
California State AGbd_8a27d24911b87d9e2016-11-29 · +7dVerified

Show 2 more filings ↓up to 17d gap

Massachusetts State AGbd_4f9871974588b2382016-11-30 · +8dVerified
Oregon State AGbd_acba0a16473f2e042016-12-09 · +17dVerified

Name: Michigan State University
norm: michigan state university
Domain: msu.edu

Name: Michigan State University
norm: michigan state university
Domain: msu.edu
Industry: Educationllm

Discovered: Nov 13, 2016
Materiality determined: —
Notification sent: —
Affected individuals: 463state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified NH Attorney General

During the incident: The affected database was immediately taken offline
MSU Police Department continues to work diligently with federal law enforcement partners to investigate the incident
MSU contracted with AllClear ID to enable affected individuals to enroll in credit monitoring and theft identity repair for a 24-month period at no cost to them
MSU provided the attached notice letters to affected individuals via email, if possible, and regular mail
MSU also posted information on its website at www.msu.edu/datasecurity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGNov 18 · first

Montana State AG+3d

New Hampshire State AG+4d · this page

South Carolina State AG+10d

California State AG+11d

Massachusetts State AG+12d

Oregon State AG+21d

Pattern: first filing Nov 18 (WA), last Dec 9 (OR) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/michigan-state-university-20161122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 22, 2016
Raw hash: c54be890a131592d0f8172842a11452ce16085fc883979e26927975fd5b95120

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMichigan State University

Victim entityMichigan State University

Incidentdiscovered Nov 13, 2016

Stated responseThe affected database was immediately taken offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov