---
title: "Ohio State Qualtrics account compromise"
description: "Ohio State disclosed a compromised Qualtrics account used to distribute phishing links."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-16"
canonical_url: "https://www.ally.security/incidents/ohio-state-qualtrics-account-compromise-2026"
markdown_url: "https://www.ally.security/incidents/ohio-state-qualtrics-account-compromise-2026.md"
stix_url: "https://www.ally.security/incidents/ohio-state-qualtrics-account-compromise-2026/stix.json"
---

# Ohio State Qualtrics account compromise

Ohio State disclosed misuse of a Qualtrics account on October 8, 2026.

Last modified Oct 16, 2026 · 1 source

## Summary

- **Environment:** Qualtrics survey account
- **Operational impact:** Account disabled; most phishing messages blocked
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Ohio State](https://www.osu.edu/) said an unauthorized user took control of a [Qualtrics](https://www.qualtrics.com/) account and created a survey workflow that distributed phishing links. [1](#source-1)

## Impact

About 8,900 university email addresses were targeted. Most messages were blocked, but some reached inboxes; affected recipients were notified. External addresses were also targeted using an uploaded list. [1](#source-1)

The target-address figure does not establish how many people were compromised. The reviewed notice does not establish data exfiltration.

## Timeline

### September 27, 2026 — Account disabled

Qualtrics detected suspicious activity and disabled the account. [1](#source-1)

### October 8, 2026 — University notice published

The university published its [incident notice](https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards). [1](#source-1)

### October 16, 2026 — Briefing updated

This briefing was last reviewed and updated on October 16, 2026.

## Threat Group & Attack Vector

The account was accessed through a legacy login route outside Ohio State’s standard single sign-on. [1](#source-1) The notice does not explain how the intruder obtained access to that route.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Ohio State and Qualtrics were investigating and assessing protections for the legacy authentication route. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/ohio-state-qualtrics-account-compromise-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Security Incident Involving Qualtrics Account Prompts Additional Safeguards

official · Ohio State Office of Technology and Digital Innovation · Oct 8, 2026

<https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: University disclosure published
2. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: Account disabled
3. **Disclosed At · 100% confidence · current**  
   Ohio State Qualtrics account compromise: 2026-10-08
4. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: Some phishing messages reached university inboxes, and affected recipients were directly notified.
5. **Occurred At · 100% confidence · current**  
   Account disabled: 2026-09-27
6. **Used Product · 100% confidence · current**  
   Ohio State Qualtrics account compromise: Qualtrics
7. **Discovered At · 100% confidence · current**  
   Ohio State Qualtrics account compromise: 2026-09-27
8. **Occurred At · 100% confidence · current**  
   University disclosure published: 2026-10-08
9. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: Access used a legacy authentication route that did not require the university’s standard single sign-on.
10. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: An unauthorized user controlled an Ohio State Qualtrics account and configured a survey and automated workflow to send phishing links.
11. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: Qualtrics automatically disabled the account after detecting suspicious activity on September 27.
12. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: Ohio State and Qualtrics were reviewing the incident and options to reduce legacy-authentication risk.
13. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: The unauthorized user uploaded a contact list and attempted phishing delivery to external recipients.
14. **Resulted In · 100% confidence · current**  
   Account disabled: Qualtrics detected suspicious activity and disabled the account.
15. **Resulted In · 100% confidence · current**  
   Ohio State Qualtrics account compromise: The campaign targeted approximately 8,900 university email addresses; email controls blocked most messages. This is a target-address count, not a confirmed compromised-person count.
16. **Affected Organization · 100% confidence · current**  
   Ohio State Qualtrics account compromise: The Ohio State University
17. **Resulted In · 100% confidence · current**  
   University disclosure published: Ohio State published its account of the compromise.

</details>