Connecticut College reveals major data breach incident ten months after it took place

Connecticut College said it experienced a cyber security incident in March last year that compromised sensitive personal information stored in its systems and took ten months to investigate.

 

In a data security incident notice posted on its website, Connecticut College said that it identified suspicious activities in its internal network in March last year and launched an internal investigation, with assistance from third party cyber security experts, to understand the nature and scope of the incident. The college also took steps to secure the affected systems and notified federal law enforcement authorities about the same.

 

The college also filed a notice of data breach with the Office of the Maine Attorney General. In its notice, the college said its internal investigation revealed that the threat actor accessed data records stored in its systems, including the sensitive personal information of individuals associated with the College.

 

The compromised data includes names, Social Security numbers, student identification numbers, education records information, financial aid information, taxpayer identification numbers, driver’s license numbers, government-issued identification numbers, financial account information, and access codes. 

 

The stolen data also included health benefits enrollment information, medical record numbers and treatment information provided to the college’s Student Health Services.

 

The college is yet to share with the state regulator the number of individuals affected by the incident, but told the AG’s office that at least 954 Maine residents were impacted.

 

“The College is notifying those members of the Conn community whose personal information was confirmed to be involved to detail the incident, what is being done to protect their information and other measures that are being taken.

 

“Interim President Les Wong apologised today to the campus community for the incident and said the College is committed to maintaining the privacy of personal information in its possession and has taken additional precautions to safeguard it,” Connecticut College said.

 

The College says it has “no evidence that any personal information has been or will be misused as a direct result of this incident.” However, the possibility of the same cannot be ruled out. 

 

The college has urged all affected individuals to remain vigilant, review their credit reports and financial statements on a regular basis, and report suspicious transactions to relevant law enforcement authorities. It is also offering credit monitoring and identity protection services through Experian Identity Works to all the individuals affected by the data breach.