Social EngineeringEducationEducationPhishingCustomer Data InvolvedIdentity (basic)Financial accountLowResolved

Colorado State University - Pueblo

bd_e08271f0e5d8cffb · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 14, 2024

Filed

Sep 4, 2024

To disclose

21 days

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Colorado State University - Pueblo →

On August 14, 2024, Colorado State University – Pueblo employees were targeted by a social engineering attack, resulting in an unauthorized third party obtaining an unprotected Excel spreadsheet. The file contained first and last names, CSU ID numbers, and current billing balances. The attacker did not breach university computer systems. The incident is resolved.

J jump to incidentP pin to compareR raw source

Vermont clock✓ VT AG ≤14 bday21 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 21 days

Aug 14, 2024

Begins

Aug 14, 2024

Discovered

Sep 4, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_0ad8be01d2f0f9412024-09-05 · +1dVerified
Massachusetts State AGbd_d5c69f32d4ae7ba32024-09-05 · +1dVerified
New Hampshire State AGbd_f5d8040d4a3cf6da2024-09-05 · +1dVerified
Indiana State AGbd_4cbc52f0b9c4f0fa2024-08-18 · +17dVerified

Name: Colorado State University - Pueblo
norm: colorado state university pueblo
Domain: csupueblo.edu

Name: Colorado State University - Pueblo
norm: colorado state university pueblo
Domain: csupueblo.edu
Industry: Educationllm

Discovered: Aug 14, 2024
Breach occurred: Aug 14, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unknown
MITRE ATT&CK: T1566 Phishing
Threat actor: External
Initial access: phishing_link

During the incident: Providing information about the event and response measures
Encouraging vigilance against future social engineering campaigns
Providing contact information for Financial Aid and Student Billing offices to verify suspicious communications
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: VT AG ≤14 bday
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGAug 18 · first

Vermont State AG+17d · this page

Montana State AG+18d

Massachusetts State AG+18d

New Hampshire State AG+18d

Pattern: first filing Aug 18 (IN), last Sep 5 (NH) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-09-04-colorado-state-university-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2024
Raw hash: a21dc27e4c567f6a93715ed199d2a3a27f3c2020c8f1a18236b42ae70bc5ebd6

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityColorado State University - Pueblo

Victim entityColorado State University - Pueblo

Incidentdiscovered Aug 14, 2024

Stated responseProviding information about the event and response measures

ComplianceVT AG ≤14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov