CDHE discloses massive data breach impacting students and teachers after a ransomware attack

The Colorado Department of Higher Education (CDHE) has revealed that it fell victim to a severe cybersecurity incident, resulting in a massive data breach affecting students, past students, and teachers.

 

According to a "Notice of Data Incident" posted on the CDHE website, the department confirmed that a ransomware attack occurred on June 19th, 2023.

 

In light of the attack, CDHE took immediate action to secure its network systems and initiated a comprehensive investigation with the assistance of third-party specialists. They also worked diligently to restore systems and resume normal operations.

 

The investigation into the CDHE incident revealed that the attackers had unauthorized access to the department’s systems between June 11th and June 19th, 2023. During this period, they managed to pilfer data spanning an extensive timeframe from 2004 to 2020.

 

The data breach poses a significant concern for those individuals who fall into the following categories:

 

• Students who attended a public institution of higher education in Colorado between 2007 and 2020.
• Attendees of Colorado public high schools between 2004 and 2020.
• Holders of a Colorado K-12 public school educator license between 2010 and 2014.
• Participants in the Dependent Tuition Assistance Program from 2009 to 2013.
• Participants in Colorado Department of Education’s Adult Education Initiatives programs between 2013 and 2017.
• Individuals who obtained a GED between 2007 and 2011.

 

The stolen information comprises highly sensitive details, including full names, social security numbers, dates of birth, addresses, proof of addresses (statements/bills), photocopies of government IDs, and, in some cases, police report or complaints related to identity theft.

 

Although the CDHE has not disclosed the exact number of individuals impacted, given the scope of the breach spanning nearly two decades, it will likely affect many people. In response to the gravity of the situation, the CDHE is offering affected individuals free access to identity theft monitoring services for 24 months.