Incident disclosureDisclosed 2024-05-07Brandywine Realty TrustSEC filing

Brandywine Realty Trust discloses a cybersecurity incident with data taken without authorization (SEC 8-K, May 2024)

On May 1, 2024, Brandywine Realty Trust (the “Company”) detected what was determined to be a cybersecurity incident, whereby a third party gained unauthorized access to portions of its information technology (“IT”)…

What happened

  • On May 1, 2024, Brandywine Realty Trust (the “Company”) detected what was determined to be a cybersecurity incident, whereby a third party gained unauthorized access to portions of its information technology (“IT”) environment.Form 8-K Item 1.05, Brandywine Realty Trust, filed 2024-05-07
  • Upon detecting the unauthorized occurrences, the Company promptly initiated its previously established response protocols and began taking steps to contain, assess and remediate the incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, shutting down some systems and notifying law enforcement.Form 8-K Item 1.05, Brandywine Realty Trust, filed 2024-05-07
  • The cybersecurity incident consisted of unauthorized access and deployment of encryption by a third party to a portion of the Company’s internal corporate IT systems.Form 8-K Item 1.05, Brandywine Realty Trust, filed 2024-05-07
  • The incident caused disruptions to, and limitation of access to, portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems.Form 8-K Item 1.05, Brandywine Realty Trust, filed 2024-05-07

The failure pattern

Insufficient segmentation lets a foothold spreadOne compromised account, vendor or network segment reaches management planes, backups and everything else.How to prevent it Audit trail missing actor, target or decisionAfter something goes wrong nobody can tell who or what took the action, on which object, or why.How to prevent it
Watch the pattern: Insufficient segmentation lets a foothold spread

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern