AccidentalEducationEducationMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

DigiPen Institute of Technology

bd_f0163e3598b3eac3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 30, 2018

Filed

May 7, 2018

To disclose

7 days

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for DigiPen Institute of Technology →2 incidents on file

DigiPen Institute of Technology notified the NH AG of an inadvertent email disclosure of student PII (names, SSNs, student IDs, programs) to an unauthorized recipient on April 25, 2018. Discovered April 30, 2018. One NH resident affected. Remediation included credit monitoring and protocol review.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 7 days

Apr 25, 2018

Begins

Apr 30, 2018

Discovered

May 7, 2018

Filed

vs. sector median

8 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_943d7e23527a2ba72018-05-07Candidate

Name: DigiPen Institute of Technology
norm: digipen institute of
Domain: digipen.edu
Industry: Education

Name: DigiPen Institute of Technology
norm: digipen institute of
Domain: digipen.edu
Industry: Education
Industry: Educationllm

Discovered: Apr 30, 2018
Breach occurred: Apr 25, 2018
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 7, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1534 Internal Remote Services
Threat actor: Internal
Regulator citations: Notified New Hampshire Department of Justice

During the incident: Initiated an investigation to determine what happened and who may have been affected
Contacted the email recipient to request that the information be returned and/or destroyed
Arranged to provide one year of credit monitoring and identity theft protection services from AllClear ID at no cost to the potentially affected individuals
Changes made: Implementing additional measures with respect to security, including reviewing and updating their internal protocols regarding the storage and transfer of personal information
Additional user education designed to prevent the recurrence of a similar incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGMay 7 · first

New Hampshire State AGMay 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/digipen-20180507.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2018
Raw hash: b2afcf46b0f63589b22b945bd210c9980df1900ba567971cb203480e40e653a8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityDigiPen Institute of Technology

Victim entityDigiPen Institute of Technology

Incidentdiscovered Apr 30, 2018

Stated responseInitiated an investigation to determine what happened and who may have been affected

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov