Cyber Incident Victim: East Tennessee State University
Date:
Oct 2018
Location:
United States of America
Summary
East Tennessee State University experienced a data breach after two employees fell victim to a targeted phishing email impersonating a supervisor, granting unauthorized access to one employee's email mailbox. The incident compromised personal information, including full names and Social Security numbers, for approximately 7,700 individuals, with additional unspecified data potentially exposed. The university disabled the affected account, reset credentials, and initiated an investigation upon discovery, subsequently notifying impacted parties.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 17, 2018, East Tennessee State University (ETSU) discovered a data breach resulting from a targeted phishing attack against its employees. Two employees clicked on fraudulent emails designed to appear as legitimate communications from a supervisor, granting an unauthorized actor access to one employee’s email mailbox. ETSU’s Information Technology Services (ITS) department immediately disabled the compromised email account, reset the affected employee’s username and password, and initiated an investigation. University spokesperson Joe Smith confirmed the phishing campaign was deliberately directed at a select group of employees rather than distributed university-wide, indicating the attackers had prior knowledge of specific targets. The breach timeline suggests the phishing emails were sent shortly before the discovery date, though the exact duration of unauthorized mailbox access remains unspecified in available reports.
ETSU’s investigation revealed that personal information belonging to approximately 7,700 individuals was potentially exposed through the compromised email account. Affected data included full names and Social Security numbers, with additional unspecified information possibly linked to some individuals. The university issued notifications to impacted parties, disclosing that the breach involved personal and familial data stored within the employee’s mailbox. No evidence suggested broader system infiltration beyond the single email account. Response efforts focused on credential resets, access termination, and victim notification, though the article does not detail subsequent security enhancements or forensic findings. The incident underscored the risks of socially engineered attacks against institutional personnel with access to sensitive records.