Colorado State University (CSU) has confirmed that the Clop ransomware operation targeted its systems and stole sensitive personal information belonging to current and former students, as well as employees, during the recent MOVEit Transfer data-theft attacks. The university, known for its status as a public research institution with a sizable student and staff population, reported the breach to its community on July 12th, 2023.
The extent and impact of the data breach are still being assessed by CSU, but the university issued a warning that the stolen data, maintained by affected vendors such as TIAA, National Student Clearinghouse, Corebridge Financial, Genworth Financial, Sunlife, and The Hartford, may include personally identifiable information such as names, dates of birth, identification numbers, social security numbers, and demographic details.
The compromise of the university’s service vendors utilizing the vulnerable MOVEit Transfer security file transfer platform led to the breach, and CSU suspects that the stolen data might date back as far as 2021, affecting both current and former members of the institution, including graduates.
An internal investigation is underway, assisted by forensic experts, to ascertain the full scope and individuals impacted by the incident, and CSU plans to send individual notification letters to those affected, providing additional resources and protection guidance.
The university urges its community members to stay vigilant and promptly report any suspicious identity theft incidents to both CSU and law enforcement authorities, as it currently doesn’t offer identity theft protection service coverage to its members.
