The Research Foundation for the State University of New York

The Research Foundation for the State University of New York experienced a data breach reported on November 12, 2021, stemming from an external system hack that occurred between May 22, 2021, and July 9, 2021. The incident compromised sensitive personal data of 4,293 individuals, including 9 Maine residents, with Social Security Numbers (SSNs) being the primary exposed information. The breach posed a significant risk of identity theft, prompting the organization to offer one year of free identity theft protection services via Experian to affected individuals. The breach was attributed to unauthorized access by external actors, indicating a targeted cyber intrusion. While the exact method of exploitation (e.g., phishing, vulnerability exploitation) was not detailed, the exposure of SSNs highly sensitive identifiers heightens the potential for long-term financial and reputational harm to victims. The foundation’s response included mitigation measures, but the breach underscores vulnerabilities in safeguarding personally identifiable information (PII) within academic and research institutions.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d7abb4c3-a7bd-42d5-a525-458cf53b44e6.shtml

TPRM report: https://www.rankiteo.com/company/rfsuny

"id": "rfs020091825",
"linkid": "rfsuny",
"type": "Breach",
"date": "5/2021",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '4,293 (including 9 Maine '
                                              'residents)',
                        'industry': 'Education/Research',
                        'location': 'New York, USA',
                        'name': 'The Research Foundation for the State '
                                'University of New York',
                        'type': 'Non-profit Organization'}],
 'attack_vector': 'External System Breach (Hacking)',
 'customer_advisories': 'Identity theft protection services offered for one '
                        'year through Experian',
 'data_breach': {'number_of_records_exposed': '4,293',
                 'personally_identifiable_information': 'Yes (SSNs)',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Social Security Numbers']},
 'date_publicly_disclosed': '2021-11-12',
 'description': 'The Maine Office of the Attorney General reported a data '
                'breach involving The Research Foundation for the State '
                'University of New York. The breach occurred between May 22, '
                '2021, and July 9, 2021, involving an external system breach '
                '(hacking) that affected 4,293 individuals, including 9 '
                'residents of Maine. The compromised information included '
                'Social Security Numbers, and identity theft protection '
                'services were offered for one year through Experian.',
 'impact': {'data_compromised': ['Social Security Numbers'],
            'identity_theft_risk': 'High (SSNs compromised)'},
 'references': [{'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': 'Maine Office of the '
                                                       'Attorney General'},
 'response': {'third_party_assistance': 'Experian (identity theft protection '
                                        'services)'},
 'title': 'Data Breach at The Research Foundation for the State University of '
          'New York',
 'type': 'Data Breach'}