Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHighContained

North Carolina State University

bd_f3b26edffd203516 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 3, 2016

Filed

Jul 8, 2016

To disclose

5 weeks

Affected · nationwide

36,40335 in this filing

Linked

3 filings

Confidence

67%

Full breach record for North Carolina State University →3 incidents on file

North Carolina State University notified New Hampshire AG of a phishing attack on June 3, 2016 that compromised an employee email account. The breach exposed names, SSNs, and 2013 mailing addresses of approximately 36,403 students. 35 New Hampshire residents were affected. NC State engaged forensics, reset credentials, implemented 2-Step Verification, and provided one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 35 days

Jun 3, 2016

Discovered

Jul 8, 2016

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_e901e4b929327b3c2016-07-08Candidate
Massachusetts State AGbd_f19f4c45c9171c902016-07-08Verified

Name: North Carolina State University
norm: north carolina state university
Industry: education

Name: North Carolina State University
norm: north carolina state university
Industry: education
Industry: Educationllm

Discovered: Jun 3, 2016
Materiality determined: —
Notification sent: —
Affected individuals: 36,403state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Working with law enforcementprovided notice as quickly as possible to the relevant regulatory bodies and agenciesnotified mediaadvised the North Carolina Attorney General’s Office
Initial access: phishing_link

During the incident: Initiated its incident response team
Performed computer forensics
Scanned the account for all possible data
Developed the notification lists
Retrieved credit monitoring codes for all potentially affected individuals
Provided notifications of the breach to the affected individuals
Provided notice as quickly as possible to the relevant regulatory bodies and agencies and three major credit bureaus
Posted notice on NC State's website
Notified media
Provided credit monitoring services to affected individuals
Removing the file and email(s) containing personal identifying information from the compromised email account
Requiring affected university employees to change their account credentials and increase security protocols, including 2-Step Verification
Requiring additional and focused information security protocols to be implemented within the affected unit as well as more broadly throughout campus to all systems containing sensitive data
Changes made: Requiring affected university employees to change their account credentials and increase security protocols, including 2-Step Verification
Requiring additional and focused information security protocols to be implemented within the affected unit as well as more broadly throughout campus to all systems containing sensitive data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJul 8 · first

Massachusetts State AGJul 8 · first

New Hampshire State AGJul 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/north-carolina-state-university-20160708.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2016
Raw hash: 9180daf21f3f41aa3388c794b23b00f27ab8a3c493ffc588a31d24edada0d52e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNorth Carolina State University

Victim entityNorth Carolina State University

Incidentdiscovered Jun 3, 2016

Stated responseInitiated its incident response team

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov