AccidentalEducationEducationMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

University of Wisconsin-Superior Alumni Association

bd_f9a183dfb245b170 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 5, 2018

Filed

Feb 22, 2018

To disclose

17 days

Affected

3state residents only

Linked

3 filings

Confidence

64%

Full breach record for University of Wisconsin-Superior Alumni Association →

University of Wisconsin-Superior Alumni Association notified NH AG of a data security incident involving 3 NH residents. On Feb 1, 2018, a mailing brochure inadvertently displayed alumni Social Security numbers (used as student IDs) above names/addresses. Discovered Feb 5, 2018. Affected data included names, addresses, and SSNs. Remediation included database cleanup, policy review, and 1-year LifeLock identity protection for affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 17 days

Feb 1, 2018

Begins

Feb 5, 2018

Discovered

Feb 22, 2018

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

South Carolina State AGbd_72a3f92c6082d1232018-02-26 · +4dVerified
Massachusetts State AGbd_f7b9a6111e037f772018-02-26 · +4dVerified

Name: Marsh & McLennan Walker Coleman & Goggin Professional Corporation
norm: marsh mclennan walker coleman goggin

Name: University of Wisconsin-Superior Alumni Association
norm: university of wisconsin superior alumni
Industry: Educationllm

Discovered: Feb 5, 2018
Breach occurred: Feb 1, 2018
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 22, 2018
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Regulator citations: Notified New Hampshire Attorney General pursuant to N.H. Rev. Stat. Ann. § 359-C:20(I)(b)

During the incident: Undertaking an internal investigation of the matter
Cleaning the alumni and friend database and replacing all of the "old" ID numbers
Verified the deletion of all mailing data used for this brochure
Reviewing its internal policies and data management protocols
Implemented enhanced security measures
Arranged to have Life Lock protect the affected individuals' identity and credit for one year
Changes made: Cleaning the alumni and friend database and replacing all of the "old" ID numbers
Reviewing its internal policies and data management protocols
Implemented enhanced security measures to help prevent this type of incident from recurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGFeb 22 · first · this page

South Carolina State AG+4d

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/university-wisconsin-alumni-20180222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2018
Raw hash: ac8f05fd1ba17c3a4b2792839f17395af08bb62ad2e77984e3d6040a86d3343e

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMarsh & McLennan Walker Coleman & Goggin Professional Corporation

Victim entityUniversity of Wisconsin-Superior Alumni Association

Incidentdiscovered Feb 5, 2018

Stated responseUndertaking an internal investigation of the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov