Pacific Lutheran University

The Washington State Office of the Attorney General disclosed a breach at Pacific Lutheran University (PLU) on January 20, 2023, stemming from an unintentional exposure of sensitive student data. The incident, which occurred on January 4, 2023, involved the mistaken disclosure of 708 individuals' names and student ID numbers likely due to a flaw in the university’s billing automation system. While no financial, medical, or highly sensitive personal information (e.g., Social Security numbers) was compromised, the exposure of student identifiers poses risks such as targeted phishing, identity fraud, or unauthorized access to linked academic records.PLU responded by reprogramming the billing automation process and introducing additional verification checkpoints to prevent recurrence. The breach did not involve external cybercriminal activity, ransomware, or systemic vulnerabilities but resulted from an internal procedural error. The impacted data, though limited in scope, could still undermine trust in the institution’s data-handling practices and potentially lead to reputational harm if exploited maliciously.

Source: https://www.atg.wa.gov/data-breach-notifications | https://data.wa.gov/resource/sb4j-ca4h.json?id=14523

TPRM report: https://www.rankiteo.com/company/plu-gradprograms

"id": "plu022090625",
"linkid": "plu-gradprograms",
"type": "Breach",
"date": "1/2023",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'customers_affected': 708,
                        'industry': 'Higher Education',
                        'location': 'Tacoma, Washington, USA',
                        'name': 'Pacific Lutheran University (PLU)',
                        'type': 'Educational Institution'}],
 'data_breach': {'number_of_records_exposed': 708,
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'Moderate (PII but no financial or '
                                        'highly sensitive data)',
                 'type_of_data_compromised': ['Student Names',
                                              'Student ID Numbers']},
 'date_detected': '2023-01-04',
 'date_publicly_disclosed': '2023-01-20',
 'description': 'The Washington State Office of the Attorney General reported '
                'a breach at Pacific Lutheran University (PLU) on January 20, '
                '2023, involving a mistaken disclosure of student names and '
                'student ID numbers. The breach occurred on January 4, 2023, '
                'affecting 708 individuals. Immediate corrective actions '
                'included reprogramming the billing automation process and '
                'implementing additional verification checkpoints.',
 'impact': {'brand_reputation_impact': 'Potential (due to public disclosure)',
            'data_compromised': ['Student Names', 'Student ID Numbers'],
            'identity_theft_risk': 'Low (limited PII exposed)'},
 'investigation_status': 'Resolved (corrective actions implemented)',
 'lessons_learned': 'Importance of verification checkpoints in automated '
                    'processes to prevent accidental data disclosures.',
 'post_incident_analysis': {'corrective_actions': ['Reprogramming of billing '
                                                   'automation process to '
                                                   'include additional '
                                                   'safeguards.',
                                                   'Implementation of '
                                                   'verification checkpoints '
                                                   'for data disclosures.'],
                            'root_causes': 'Human error in billing automation '
                                           'process leading to unauthorized '
                                           'disclosure of student data.'},
 'recommendations': ['Implement multi-layered approval workflows for sensitive '
                     'data disclosures.',
                     'Conduct regular audits of automated systems handling '
                     'PII.',
                     'Enhance employee training on data handling best '
                     'practices.'],
 'references': [{'date_accessed': '2023-01-20',
                 'source': 'Washington State Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': ['Washington State '
                                                        'Office of the '
                                                        'Attorney General']},
 'response': {'communication_strategy': 'Public disclosure via Washington '
                                        'State Office of the Attorney General',
              'containment_measures': ['Reprogramming of billing automation '
                                       'process'],
              'incident_response_plan_activated': True,
              'remediation_measures': ['Additional verification checkpoints '
                                       'implemented']},
 'title': 'Pacific Lutheran University (PLU) Data Breach – Unauthorized '
          'Disclosure of Student Information',
 'type': 'Data Breach (Unauthorized Disclosure)',
 'vulnerability_exploited': 'Human Error (Mistaken Disclosure)'}