Social EngineeringHealthcareEducationHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Augusta University

bd_f43e90777d0b6a63 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 31, 2018

Filed

Sep 4, 2018

To disclose

5 weeks

Affected

14state residents only

Linked

3 filings

Confidence

66%

Full breach record for Augusta University →

Augusta University notified the NH AG of a phishing incident affecting 14 NH residents. Attackers used fraudulent emails to steal credentials for internal email accounts. The incident occurred Sept 10-11, 2017, and was discovered July 31, 2018. Compromised data included names, PHI, SSNs, and financial info. Notifications began Aug 30, 2018.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 324 days

discovery → filing · 5 weeks / 35 days

Sep 10, 2017

Begins

Jul 31, 2018

Discovered

Sep 4, 2018

Filed

vs. sector median

7 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

South Carolina State AGbd_3794b236c93216792018-09-04Candidate
Massachusetts State AGbd_0e0888f2753c07572018-09-05 · +1dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Augusta University
norm: augusta university
Domain: augusta.edu
Industry: HealthcarellmEducationllm

Discovered: Jul 31, 2018
Breach occurred: Sep 10, 2017 – Sep 11, 2017
Undetected for: 324 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2018
Affected individuals: 14state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the Secretary of the U.S. Department of Health and Human Services Office for Civil Rights, pursuant to 45 CFR 164.408
Initial access: phishing_link

During the incident: Disabling the impacted email accounts
Requiring password changes for the compromised accounts
Maintaining heightened monitoring of the accounts
Commenced an investigation into the incident
Engaged external cybersecurity professionals to analyze the extent of any compromise
Changes made: Installing new leadership in a number of critical areas
Implementing multifactor authentication for off-campus email and system access
Reviewing and adopting of solutions to limit email retention
Implementing policy and procedure changes regarding protected health information in email communications
Employing software to screen emails for protected health information or personally identifiable information to prevent them from sending
Increasing employee training on their critical role in preventing security breaches
Enhancing compliance-related policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

South Carolina State AGSep 4 · first

New Hampshire State AGSep 4 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/augusta-university-20180904.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2018
Raw hash: bb22805f3575fb842f756f44a7cf0fa8f1c03d78ef49f1e6e3849473f6a641a1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityAugusta University

Incidentdiscovered Jul 31, 2018

Stated responseDisabling the impacted email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov