HackingVulnerability ExploitData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICLowContained
Oak Ridge Associated Universities, Incorporated
bd_d835c740d4993730 · schema v1 · pii pii-v1
Full breach record for Oak Ridge Associated Universities, Incorporated →Oak Ridge Associated Universities (ORAU) notified former DOE workers of a data breach involving MOVEit Transfer software. A criminal organization exploited a vulnerability in the software to exfiltrate personal information (names, addresses, etc.) between May 28-30, 2023. ORAU discovered the vulnerability on May 31, 2023, and notified law enforcement and the DOE. Affected individuals were offered credit monitoring and identity theft protection services.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_47bcff9365e9eef7Vermont State AGfiled 2023-08-21Verified
- bd_991a0ec14d6a0e3bMaine State AGfiled 2023-08-21Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/oak-ridge-associated-universities-20230821.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 21, 2023
- Raw hash
- dcb11f67ee4ebd668423482244a2140dd26affab905cbde75ff34a19b60c2935
Reporting entity
- Name
- Oak Ridge Associated Universities, Incorporatednorm: oak ridge associated universities
- Domain
- orau.org
Victim entity
- Name
- Oak Ridge Associated Universities, Incorporatednorm: oak ridge associated universities
- Domain
- orau.org
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Aug 21, 2023
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- contacted DOE
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 12 weeks(82 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.