HackingEducationEducationStolen CredentialsTargetedSupply Chain (3P Vendor)Employee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Stanford University

bd_d27e492d8f977022 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 4, 2016

Filed

Jun 13, 2016

To disclose

10 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Stanford University →8 incidents on file

Stanford University notified affected individuals that their W-2 forms were improperly downloaded from Equifax's W-2Express service by an unauthorized person using valid credentials (SSN and DOB). The incident was discovered on April 4, 2016, after employees reported fraudulent tax returns. The attack occurred in late March 2016. Stanford disabled the service, engaged law enforcement, and offered credit monitoring. Data exposed included names, addresses, SSNs, DOBs, and wage/tax information.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 4, 2016 → Notified Apr 14, 201610d ✓ CA 60-day OK10 weeks discovery → filing

Incident timeline

undetected · 20 days

discovery → filing · 10 weeks / 70 days

Mar 15, 2016

Begins

Apr 4, 2016

Discovered

Jun 13, 2016

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_453b79b1c72ee4262016-06-16 · +3dVerified
Massachusetts State AGbd_2bb4b729d5d13ead2016-06-20 · +7dVerified

Name: Stanford University
norm: stanford university
Domain: stanford.edu

Name: Stanford University
norm: stanford university
Domain: stanford.edu
Industry: Educationllm

Discovered: Apr 4, 2016
Breach occurred: Mar 15, 2016 – Mar 31, 2016
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 14, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Third party: via Equifax
Initial access: valid_credentials

During the incident: Disabled the W-2Express service on April 5, 2016
Working closely with Equifax and law enforcement to investigate further
Issued an alert about tax fraud to the Stanford Community on April 4, 2016
Emailed all Stanford employees to inform them of the matter and the University’s investigation on April 7, 2016
Included announcement in the Stanford Report newsletter on April 8, 2016
Issued an email communication to potentially affected individuals on April 14, 2016
Providing two comparable credit monitoring and protection services options, AllClear Pro TBO and Equifax ID Patrol
Changes made: Reviewing procedures in order to help to prevent this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: CA 60-day OK · 10d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 4, 2016
→ Notified: Apr 14, 2016
10d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 4, 2016 → Notified: Apr 14, 2016	10d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGJun 13 · first · this page

New Hampshire State AG+3d

Massachusetts State AG+7d

Pattern: first filing Jun 13 (CA), last Jun 20 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-62341
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 13, 2016
Raw hash: e17dde88124d44cde80747aa67fcfebc40c1a5ed0e6592d1e609b1260b6d0d30

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityStanford University

Victim entityStanford University

Incidentdiscovered Apr 4, 2016

Stated responseDisabled the W-2Express service on April 5, 2016

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov