Summary
- Environment: Qualtrics survey account
- Operational impact: Account disabled; most phishing messages blocked
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 16, 2026; updated as evidence emerges.
What happened
Ohio State said an unauthorized user took control of a Qualtrics account and created a survey workflow that distributed phishing links. [1]
Impact
About 8,900 university email addresses were targeted. Most messages were blocked, but some reached inboxes; affected recipients were notified. External addresses were also targeted using an uploaded list. [1]
The target-address figure does not establish how many people were compromised. The reviewed notice does not establish data exfiltration.
Timeline
Account disabled
Qualtrics detected suspicious activity and disabled the account.
[1]University notice published
The university published its incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on October 16, 2026.
Threat Group & Attack Vector
The account was accessed through a legacy login route outside Ohio State’s standard single sign-on. [1] The notice does not explain how the intruder obtained access to that route.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Ohio State and Qualtrics were investigating and assessing protections for the legacy authentication route. [1]