HackingEducationEducationVulnerability ExploitCLOPData ExfiltratedTargetedGovernment IDFinancial accountPIIHighContained

University System of Georgia

bd_ff8f8d46c4b55435 · schema v1 · pii pii-v1

Severity

High

Discovered

May 31, 2023

Filed

Apr 1, 2024

To disclose

44 weeks

Affected

9,100state residents only

Linked

8 filings

Confidence

67%

Full breach record for University System of Georgia →

University System of Georgia (USG) notified South Carolina residents of a data breach involving MOVEit Secure File Transfer software. The vulnerability allowed unauthorized access by the CLOP cybercriminal group starting May 28, 2023. USG detected the breach on May 31, 2023, blocked the software, and secured the system. Affected data included SSNs, dates of birth, bank account numbers, and tax documents. USG is offering Experian IdentityWorks to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d44 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 44 weeks / 306 days

May 28, 2023

Begins

May 31, 2023

Discovered

Apr 1, 2024

Filed

vs. sector median

+37 wks slower

This filing is one of 8 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 268 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_72e2f544722c205d2023-07-07 · +268dVerified by operator

Regulatory filings (6) · sorted by filing gap

Vermont State AGCL0Pbd_a050588dda8888622024-04-01Verified by operator
Washington State AGCLOPbd_bb40387f4a8f96152024-03-29 · +3dVerified by operator
California State AGCL0Pbd_3c4f63a7a68d76022024-03-28 · +4dVerified by operator
Oregon State AGbd_a72e0f79e01a59632024-03-28 · +4dVerified by operator

Show 2 more filings ↓up to 36d gap

Indiana State AGbd_bda820409fadae882024-04-19 · +18dVerified by operator
Maine State AGbd_a69a31c89d88dc892024-05-07 · +36dVerified by operator

Name: University System of Georgia
norm: university system of georgia
Domain: regents.usg.edu

Name: University System of Georgia
norm: university system of georgia
Domain: regents.usg.edu
Industry: Educationllm

Discovered: May 31, 2023
Breach occurred: May 28, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 9,100state-resident count only
Data types: Government IDFinancial accountPII
Data elements: Social Security number
Attack vector: Unauthorized Access· CLOP
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: CLOPExternalFinancial
Regulator citations: Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) have determined that data was acquired
Initial access: exploit_public_facing

During the incident: MOVEit Transfer software operating at USG was immediately blocked upon detection of the breach
System has now been fully updated and secured in accordance with guidance from Progress Software and CISA
Began a lengthy investigation to determine which individuals may have been impacted
Offering complimentary access to Experian IdentityWorks
Changes made: Updated and secured MOVEit Transfer software
Offering complimentary access to Experian IdentityWorks for identity theft protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(306 days from discovery to filing)
Compliance flags: Leak >180dSC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGMar 28 · first

Oregon State AGMar 28 · first

Washington State AG+1d

Vermont State AG+4d

South Carolina State AG+4d · this page

Indiana State AG+22d

Maine State AG+40d

Pattern: first filing Mar 28 (CA), last May 7 (ME) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2024/UniversitySystemofGeorgia.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 1, 2024
Raw hash: a3976fce37e81b33b1a91133a5a83343d3df7891f012e215ead7624840731db1

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityUniversity System of Georgia

Victim entityUniversity System of Georgia

Incidentdiscovered May 31, 2023

Stated responseMOVEit Transfer software operating at USG was immediately blocked upon detection of the breach

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov