Malware
Breaking News: Colorado State University Discovers Devastating Data Breach Affecting Students and Staff
Colorado State University has confirmed a data breach that has affected both students and staff members. The incident, which occurred in June, involved unauthorized access to an employee’s email account. While investigations are ongoing, the university assures that no Social Security numbers or financial data were compromised. Affected individuals are being provided with support and resources to safeguard their information.
Colorado State University Confirms Data Breach by Clop Ransomware Operation
Colorado State University (CSU) has confirmed that sensitive personal information of current and former students and employees was stolen by the Clop ransomware operation during the recent MOVEit Transfer data-theft attacks.
About Colorado State University
Colorado State University is a public research university with nearly 28,000 students and 6,000 academic and administrative staff members. The university operates on an endowment of $558,000,000.
Data Breach Notification
The university informed its students and staff on July 12th, 2023, about the breach and the unauthorized access to personal data through the MOVEit Transfer attacks.
CSU has dedicated a webpage to provide information about the cyber incident. Although the full extent and impact of the data breach are still being assessed, the university has released a statement regarding the compromised data.
“Some data about prospective, current, and former CSU students and current and former employees maintained by the affected vendors contains personally identifiable information, which may include first name, middle initial, last name, date of birth, student or employee identification numbers, social security number, and demographic information such as gender, ethnicity, and level and area of education.” CSU warned.
The stolen data dates back to at least 2021, possibly earlier, which means that even graduates could be impacted.
Vendor Compromise
The data leak is not a result of a direct breach of CSU’s systems but rather a compromise of the university’s service vendors. The affected vendors include TIAA, National Student Clearinghouse, Corebridge Financial, Genworth Financial, Sunlife, and The Hartford.
All of these vendors utilized the MOVEit Transfer security file transfer platform, which was breached in a series of data-theft attacks in May 2023.
CSU notes that these vendors provide services to many universities across the United States, so it’s possible that other educational institutes will release similar breach notifications soon.
Response and Investigation
CSU is currently conducting an internal investigation with the assistance of forensic experts to determine the extent of the breach and identify the affected individuals. The university will send individual notification letters to those impacted, providing additional resources and guidance for protection.
What Is the Relationship Between the Data Breach at Colorado State University and the Alarm Raised by the Colorado Department of Higher Education?
The colorado higher education data breach at Colorado State University has triggered an alarm from the Colorado Department of Higher Education. This incident has fostered a closer relationship between these two entities, as they collaborate to tackle the aftermath and strengthen security measures across the state’s institutions.
Protective Measures
Meanwhile, all members of the CSU community are advised to remain vigilant and report any suspected incidents of identity theft to the university and law enforcement authorities.
At present, CSU does not offer identity theft protection service coverage to its members. However, the Federal Trade Commission (FTC) provides guidance on protecting against identity theft, which CSU recommends following.
H/T: Brett Callow