2022-2023 Paul Smith’s College Data Breach

One-sentence summary:

Potentially AvosLocker breached Paul Smith’s College network, stealing data and SSNs for over 10,000+ persons, and remained undetected for almost six months.

Who was involved?

Threat actor (potentially AvosLocker), Paul Smith’s College, and 10,615 persons and 71 Maine residents (HackNotice, 2022; Office of the Maine Attorney General, 2023, para. 2).

What was the timeline?

Breach duration: 07/01/2022 – 08/31/2022

Discovery: 01/26/2023

Reported: 02/17/2023

(Office of the Maine Attorney General, 2023, para. 3).

What occurred?

Potentially AvosLocker breached Paul Smith’s College network for several months in 2022, stealing data and SSNs (social security numbers) for over 10,000+ persons (Office of the Maine Attorney General, 2023, para. 3). The information was posted online via Tor/Onion in September (HackNotice, 2022). Paul Smith’s College did not know of the breach until January 26, 2023, and did not notify the public and victims until February 17, 2023 (Office of the Maine Attorney General, 2023, para. 3).

Estimated costs:

Outside incident response costs, data breach notification costs, and identity theft reporting costs (12-Months / Experian – IdentityWorks Credit 3B) (Paul Smith’s College, 2023, p. 1; Office of the Maine Attorney General, 2023, para. 4). Legal costs (law firm seen representing the college) (Office of the Maine Attorney General, 2023, para. 2).

Involved laws:

Potentially FERPA. Maine state law: 10 M.R.S.A. § 1346.

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

HackNotice. (2022, September 10). HackNotice: Paul Smiths College Hack. hacknotice.com. Retrieved February 17, 2023, from https://app.hacknotice.com/

Office of the Maine Attorney General. (2023, February 17). Office of the Maine AG: Consumer Protection: Privacy, Identity Theft and Data Security Breaches. maine.gov. Retrieved February 17, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/eca32f8f-7a9c-42cd-bcd8-cd5a83369f71.shtml

Paul Smith’s College. (2023). PSC — Redacted 12-Month Notification Letter (11002527x7AB84).pdf. In maine.gov. Office of the Maine Attorney General. Retrieved February 17, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/eca32f8f-7a9c-42cd-bcd8-cd5a83369f71/169ea682-9112-4f1d-b3b4-7f021ac1d79a/document.html

About Post Author

Kyler Kent CISSP

I am a Threat Hunting and Intelligence Specialist and am a progressive, aspiring cyber leader. I am currently based in Dallas, with a holistic and multidisciplinary background. I am a lifelong learner– constantly seeking education and training opportunities. I maintain several cybersecurity and IT certifications. I also maintain two Texas DPS private security licenses. Finally, I have a master’s degree from Georgetown University’s SCS Cybersecurity Risk Management program. https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com