National Student Clearinghouse discloses data breach affecting 900 US schools

The National Student Clearinghouse (NSC), a nonprofit organization providing educational verification and reporting services, has reported a data breach impacting approximately 900 educational institutions in the United States.

The breach resulted from a cyber attack exploiting a vulnerability in MOVEit, a managed file transfer tool. This attack is part of a larger hacking campaign that targeted organizations globally at the end of May.

On May 31, 2023, the NSC was alerted by its third-party software provider, Progress Software, about a cybersecurity issue involving MOVEit Transfer, which is widely used by organizations, including NSC, for secure data file transfers.

Following this notification, the NSC initiated a thorough investigation with the assistance of cybersecurity experts and coordinated with law enforcement agencies. On June 20, 2023, it was confirmed that an unauthorized party had accessed certain files from MOVEit, with the incident occurring around May 30, 2023.

The breach exposed personal information, including names, dates of birth, contact details, Social Security numbers, student ID numbers, and various school-related records such as enrollment and degree information. The extent of data affected varied from person to person.

National Student Clearinghouse advises those affected to stay vigilant by monitoring their account statements and reviewing free credit reports for suspicious activities. The breach has been attributed to the Clop ransomware group, also known as Lace Tempest, which exploited a vulnerability in the MOVEit Transfer software.