Cyber Incident Victim: Midland University
Date:
Jan 2021
Location:
United States of America
Summary
Midland University experienced a ransomware attack involving unauthorized encryption and exfiltration of files containing sensitive personal information, including names, addresses, Social Security numbers, driver’s licenses, state identification numbers, and financial account details. The institution engaged forensic specialists and law enforcement, secured systems, restored operations, and confirmed data access by threat actors. Approximately 13,716 individuals were potentially affected nationwide, with 645 confirmed impacted residents in Iowa.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 18, 2021, Midland University in Nebraska discovered a ransomware attack that encrypted files on its network. The university immediately initiated an investigation with third-party computer forensic specialists to assess the nature and scope of the incident and notified federal law enforcement. Attackers gained access to certain files on the same day, encrypting data and exfiltrating a subset of files. Midland's response focused on three priorities: securing compromised systems, restoring operational access to minimize disruption, and determining whether unauthorized data access or theft occurred. The forensic investigation confirmed the attackers downloaded files but did not establish immediate evidence of data misuse.
The compromised files contained personally identifiable information, including names, addresses, Social Security numbers, driver’s license or state identification numbers, and financial account details. Midland notified 645 Iowa residents whose data was specifically exposed, as reported to the Iowa Attorney General’s office. A broader impact was revealed in the university’s filing with the Maine Attorney General, indicating 13,716 individuals were potentially affected nationwide. Notification letters were issued approximately one year after the breach discovery, reflecting the absence of federally mandated notification deadlines under FERPA, unlike HIPAA’s 60-day requirement. The incident did not disrupt university operations due to rapid containment and restoration efforts. Midland did not disclose whether a ransom was paid or identify the responsible threat actor.