HackingEducationEducationVulnerability ExploitCapture Stored DataData ExfiltratedTargetedHealth (basic)Identity (basic)Government IDPHIHighContained

Oak Ridge Associated Universities, Incorporated

bd_fd982dc95fd180e5 · schema v1 · pii pii-v1

Severity

High

Discovered

May 31, 2023

Filed

Aug 21, 2023

To disclose

12 weeks

Affected

1,671state residents only

Linked

11 filings

Confidence

71%

Full breach record for Oak Ridge Associated Universities, Incorporated →2 incidents on file

Oak Ridge Associated Universities (ORAU) reported a cybersecurity incident involving the MOVEit Transfer software. An unauthorized actor exploited a vulnerability to access data between May 28-30, 2023. ORAU discovered the vulnerability on May 31, 2023. The breach affected 1,671 Washington residents, exposing names, Social Security numbers, and medical treatment information. Notifications were sent on August 21, 2023.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d12 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 12 weeks / 82 days

May 28, 2023

Begins

May 31, 2023

Discovered

Aug 21, 2023

Filed

vs. sector median

+3 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_964719921d9afe4f2023-07-26 · +26dVerified by operator

Regulatory filings (9) · sorted by filing gap

Oregon State AGbd_1be1194ec55748642023-08-21Verified
California State AGbd_393e41f072f2bf092023-08-21Verified by operator
Vermont State AGbd_47bcff9365e9eef72023-08-21Verified by operator
Massachusetts State AGbd_6ce30d92e1f562672023-08-21Verified by operator

Show 5 more filings ↓up to 3d gap

Montana State AGbd_886bd4fa64f2a2ba2023-08-21Verified
Maine State AGbd_991a0ec14d6a0e3b2023-08-21Verified by operator
New Hampshire State AGbd_d835c740d49937302023-08-21Verified by operator
Indiana State AGbd_decca8f8082609c72023-08-21Verified
South Carolina State AGbd_9c88bb16eff983962023-08-24 · +3dVerified

Name: Oak Ridge Associated Universities, Incorporated
norm: oak ridge associated universities
Domain: orau.org

Name: Oak Ridge Associated Universities, Incorporated
norm: oak ridge associated universities
Domain: orau.org
Industry: Educationllm

Discovered: May 31, 2023
Breach occurred: May 28, 2023 – May 30, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 21, 2023
Affected individuals: 1,671state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: NameSocial Security numberMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcementWorked with the Department of Energy (DOE)
Initial access: exploit_public_facing

During the incident: Contacted law enforcement
Launched an investigation
Offered notified residents credit monitoring and identity theft protection services through IDX
Established a dedicated, toll-free call center
Changes made: Continue to explore opportunities to enhance the security of the information that we maintain
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(82 days from discovery to filing)
Compliance flags: Leak >180dWA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Oregon State AGAug 21 · first

California State AGAug 21 · first

Vermont State AGAug 21 · first

Massachusetts State AGAug 21 · first

Montana State AGAug 21 · first

Maine State AGAug 21 · first

New Hampshire State AGAug 21 · first

Indiana State AGAug 21 · first

Washington State AGAug 21 · first · this page

South Carolina State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26280.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2023
Raw hash: 9b7b6b80c709b20a567efdc785ec1da2c5ea0f16a7d3f6e7b220455432f57678

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityOak Ridge Associated Universities, Incorporated

Victim entityOak Ridge Associated Universities, Incorporated

Incidentdiscovered May 31, 2023

Stated responseContacted law enforcement

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com