PhysicalEducationEducationTheftCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)MediumContained

Tufts University

bd_fbe9c531384a6c34 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 16, 2011

Filed

Jul 7, 2011

To disclose

21 days

Affected · nationwide

731 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Tufts University →7 incidents on file

Tufts University notified the NH AG that a stolen laptop containing SSNs of 73 individuals (1 NH resident) was stolen in late April 2011. Discovered June 16, 2011. Notices mailed July 8, 2011. Credit monitoring offered. Remediation included new security program and policy changes.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 21 days

Apr 1, 2011

Begins

Jun 16, 2011

Discovered

Jul 7, 2011

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_49857175755cbb0c2011-07-08 · +1dVerified

Name: Tufts University
norm: tufts university
Domain: tufts.edu

Name: Tufts University
norm: tufts university
Domain: tufts.edu
Industry: Educationllm

Discovered: Jun 16, 2011
Breach occurred: Apr 1, 2011 – Apr 30, 2011
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 8, 2011
Affected individuals: 73state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Filed a police report
Notified the Attorney General
Offering each affected person one year of free credit monitoring from Experian
Mailing notices to affected individuals
Changes made: Implemented a Written Information Security Program
Appointed information stewards for each of the schools throughout the university
Requiring users to identify where personal information is being stored
Requiring users to securely destroy information that is no longer needed
Requiring users to maintain adequate security safeguards for personal information
Social Security numbers are no longer distributed to faculty members as part of the admissions process
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJul 7 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tufts-university-20110707.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2011
Raw hash: 9208de961c4307d547e7adf8b606697534fc295438edc80d5726f4f4be159429

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTufts University

Victim entityTufts University

Incidentdiscovered Jun 16, 2011

Stated responseFiled a police report

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov