HackingEducationEducationStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

NORTH UNIVERSITY PARK, LLC

bd_d37025a971937cfa · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 23, 2019

Filed

Jan 3, 2020

To disclose

15 weeks

Affected

6state residents only

Linked

3 filings

Confidence

66%

Full breach record for NORTH UNIVERSITY PARK, LLC →3 incidents on file

North Park University notified the NH AG of unauthorized access to an employee email account between Aug 8 and Sep 5, 2019. Discovered Sep 23, 2019. Affected ~6 NH residents; data included names and SSNs. Response included credential reset, forensic investigation, and 12 months credit monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 46 days

discovery → filing · 15 weeks / 102 days

Aug 8, 2019

Begins

Sep 23, 2019

Discovered

Jan 3, 2020

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_2ecaa5d38e5967102019-12-30 · +4dCandidate
Massachusetts State AGbd_468eb6763697865a2019-12-30 · +4dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: NORTH UNIVERSITY PARK, LLC
norm: north university park
Industry: Educationllm

Discovered: Sep 23, 2019
Breach occurred: Aug 8, 2019 – Sep 5, 2019
Undetected for: 46 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 30, 2019
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Changed the account credentials
Launched an investigation, with the assistance of a third-party computer forensics expert
Conducted a thorough manual and programmatic review to determine what information was contained in the email account
Confirmed the identities of individual who may have had information accessible in the email account
Reviewed their files to ascertain address information for the impacted individuals
Provided written notice of this incident to affected individuals
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for twelve (12) months, through Kroll
Changes made: Implementing increased security measures for account access such as multi-factor authentication
Additional employee training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(102 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGDec 30 · first

Massachusetts State AGDec 30 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/north-park-university-20200103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 3, 2020
Raw hash: dd728a27938e487d73a514848b31a13c62e7d7ec866c5aed7d842f01e7209754

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityNORTH UNIVERSITY PARK, LLC

Incidentdiscovered Sep 23, 2019

Stated responseChanged the account credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov