Cyber Incident Victim: We End Violence
Date:
Aug 2014
Location:
United States of America
Summary
We End Violence experienced a potential intrusion into its Agent of Change educational platform, compromising sensitive personal and demographic information of approximately 79,000 students across eight California State University campuses. Exposed data included names, student IDs, email addresses, account credentials, gender identities, racial and ethnic details, ages, relationship statuses, sexual orientations, and institutional affiliations. The organization took the affected website offline to implement security enhancements, mandated password resets for users, issued phishing alerts, and notified all impacted individuals, though no evidence of data misuse was confirmed at the time of disclosure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
We End Violence, a California-based violence prevention education organization, discovered a potential intrusion into its Agent of Change website server on August 24, 2014. The breach exposed personal information of users who had registered on the platform, primarily impacting students from eight California State University campuses. Approximately 79,000 students were affected by the incident, which compromised multiple categories of sensitive data including names, student ID numbers, email addresses provided both by the university and during registration, Agent of Change usernames and passwords, gender identities, races, ethnicities, ages, relationship statuses, sexual identities, and institutional affiliations. The organization took immediate action by shutting down the compromised website on August 26, 2014, two days after detecting the intrusion. While no evidence of information misuse was found, the breadth of exposed data created significant privacy concerns given the inclusion of personally identifiable information and sensitive demographic details.
The organization initiated a multi-phase response beginning with notifications to all affected clients and individual users. We End Violence worked to restore the Agent of Change website with enhanced security measures and implemented mandatory password resets for all account holders. Users received warnings about potential phishing attempts leveraging the compromised email addresses and credentials. The breach notification process included direct communication with institutional partners at California State University campuses impacted by the incident. Forensic investigation confirmed unauthorized access to the web server hosting the educational platform, though the specific methods of intrusion and attacker identity remained undisclosed. The incident highlighted risks associated with third-party educational service providers handling sensitive student data through web-based platforms interfacing with university systems.