HackingEducationEducationStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

FRANCISCAN UNIVERSITY OF STEUBENVILLE

bd_dd9d680b53e71d98 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Dec 3, 2018

To disclose

—

Affected

19state residents only

Linked

3 filings

Confidence

65%

Full breach record for FRANCISCAN UNIVERSITY OF STEUBENVILLE →

Franciscan University of Steubenville notified the NH Attorney General of a data security incident in October 2018 where an unauthorized third party compromised a limited number of business email accounts. The incident potentially affected the names and Social Security numbers of 19 New Hampshire residents. The University blocked access, engaged outside experts, notified the FBI, and offered 24 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 1, 2018

Begins

Dec 3, 2018

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_2c6d631e5c9df1f72018-11-30 · +3dCandidate
Massachusetts State AGbd_1b956b943a6e61c72018-11-29 · +4dVerified

Name: FRANCISCAN UNIVERSITY OF STEUBENVILLE
norm: franciscan university of steubenville
Domain: www.franciscan.edu

Name: FRANCISCAN UNIVERSITY OF STEUBENVILLE
norm: franciscan university of steubenville
Domain: www.franciscan.edu
Industry: Educationllm

Discovered: —
Breach occurred: Oct 1, 2018 – Oct 31, 2018
Materiality determined: —
Notification sent: Nov 30, 2018
Affected individuals: 19state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation

During the incident: Took immediate action to block further unauthorized access to University email accounts
Determined what information may have been impacted with the assistance of outside experts
Contacted the Federal Bureau of Investigation in order to provide notice of this incident and seek assistance
Required employees to change their passwords
Changes made: Conduct ongoing security analysis and testing of our network
Configure added levels of security within our software applications
Conduct a thorough review of our ITS security policies and procedures
Deliver training programs for all of our faculty and staff to increase awareness
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 29 · first

Montana State AG+1d

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/franciscan-university-20181205.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 3, 2018
Raw hash: 850b3eac394134a67424b57589f1cc867697108e940948fa91be21bdf5744c1c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFRANCISCAN UNIVERSITY OF STEUBENVILLE

Victim entityFRANCISCAN UNIVERSITY OF STEUBENVILLE

IncidentUnauthorized Access

Stated responseTook immediate action to block further unauthorized access to University email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov