HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Alderson Broaddus University

bd_f805a7c25ffe93f1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 27, 2021

Filed

Jun 10, 2021

To disclose

19 weeks

Affected

17state residents only

Linked

6 filings

Confidence

66%

Full breach record for Alderson Broaddus University →

Alderson Broaddus University notified the New Hampshire Attorney General of a security incident where an unauthorized person accessed systems between Jan 22-27, 2021, and exfiltrated files containing names and SSNs of 17 NH residents. The university secured its network, engaged law enforcement and a cybersecurity firm, and provided 17 residents with one year of credit monitoring and identity theft restoration services via Kroll. Additional safeguards included MFA and enhanced password requirements.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 19 weeks / 134 days

Jan 22, 2021

Begins

Jan 27, 2021

Discovered

Jun 10, 2021

Filed

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_10019c49d6f1337f2021-06-10Candidate
Massachusetts State AGbd_11f0bdffee3edcea2021-06-10Verified
California State AGbd_71a01e4fe36779bd2021-06-10Verified
Montana State AGbd_e482d84a800cc8ee2021-06-10Candidate

Show 1 more filing ↓

Indiana State AGbd_eb791738239792fd2021-06-10Verified

Name: Alderson Broaddus University
norm: alderson broaddus university

Name: Alderson Broaddus University
norm: alderson broaddus university
Industry: Educationllm

Discovered: Jan 27, 2021
Breach occurred: Jan 22, 2021 – Jan 27, 2021
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 10, 2021
Affected individuals: 17state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to secure its network
Contacted law enforcement
Began an investigation with the assistance of a cybersecurity firm
Mailed written notification to the New Hampshire residents via First Class U.S. Mail
Providing each of the New Hampshire residents complimentary, one-year memberships to credit monitoring, fraud consultation, and identity theft restoration services through Kroll
Established a dedicated call center
Changes made: Implemented additional safeguards and technical security measures, including multi-factor authentication, additional password requirements, migrating systems to an additional endpoint detection and response tool, and third-party network monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(134 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGJun 10 · first

Massachusetts State AGJun 10 · first

California State AGJun 10 · first

Montana State AGJun 10 · first

Indiana State AGJun 10 · first

New Hampshire State AGJun 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/alderson-broaddus-20210610.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 10, 2021
Raw hash: 9bf2f337a946ada0b1c7be91dc1c9440e547d032a2711721a99f3948eea3a39a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAlderson Broaddus University

Victim entityAlderson Broaddus University

Incidentdiscovered Jan 27, 2021

Stated responseTook steps to secure its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov