AccidentalEducationHealthcareEducationMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PIIMediumContained

Rocky Mountain University of Health Professions

bd_df44ebf0d0ddc6b8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 28, 2023

Filed

Jan 12, 2024

To disclose

37 weeks

Affected

6state residents only

Linked

3 filings

Confidence

66%

Full breach record for Rocky Mountain University of Health Professions →

Rocky Mountain University of Health Professions notified individuals of a data security incident discovered on April 28, 2023, caused by a website configuration error. Unauthorized access may have exposed names, contact info, SSNs, driver's licenses, passports, DOBs, and medical information. The university engaged a third-party cybersecurity firm for forensic investigation and remediation, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 37 weeks / 259 days

Apr 28, 2023

Discovered

Jan 12, 2024

Filed

vs. sector median

+28 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_28acdf3db683d43b2024-01-12Verified
Indiana State AGbd_4074d9094035511c2024-01-12Verified

Name: Rocky Mountain University of Health Professions
norm: rocky mountain university of health professions

Name: Rocky Mountain University of Health Professions
norm: rocky mountain university of health professions
Industry: EducationllmHealthcarellm

Discovered: Apr 28, 2023
Materiality determined: —
Notification sent: Jan 12, 2024
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security numberDate of birthMedical information
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application

During the incident: Fixed the configuration issue
Engaged a specialized third-party cybersecurity firm to assist with securing the environment
Conducted a comprehensive forensic investigation
Performed data mining on the affected systems/accounts
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Resolved the website configuration error
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(259 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJan 12 · first

Indiana State AGJan 12 · first

Montana State AGJan 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1023.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2024
Raw hash: e8537d8db8ccc4f2808ffde7a2918aeadae42ef2b90592b4a9c9f51503db1669

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityRocky Mountain University of Health Professions

Victim entityRocky Mountain University of Health Professions

Incidentdiscovered Apr 28, 2023

Stated responseFixed the configuration issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov