Boston's Emmanuel College says 2023 cyber attack impacted close to 90,000 individuals

Boston, Massachusetts-based Emmanuel College said that close to 90,000 people were affected due to a serious cyber attack that targeted its systems in 2023.

 

In a filing with the Office of the Maine Attorney General, Emmanuel College said that it identified suspicious activities in its internal network last year. The college launched an internal investigation with assistance from third party cyber security experts to understand the nature and scope of the incident.

 

The investigation, which concluded on January 16, revealed that on April 27, threat actors infiltrated Emmanuel College’s network and exfiltrated files from its internal network. The files contained sensitive personal details of individuals associated with the college, including their names and other personal identifiers, financial account numbers, credit and debit card numbers in combination with security codes, access codes, passwords and PIN for the accounts.

 

Emmanuel College said in its filing with the state regulator that at least 89,064 individuals were affected by the data security incident.

 

“Upon learning of this issue, we contained the threat, notified law enforcement and immediately commenced a prompt and thorough investigation. As part of our investigation, we have been working very closely with external cybersecurity professionals experienced in handling these types of incidents,” it said.

 

Emmanuel College added that it found no evidence of the compromised data being misused, but the possibility for the same cannot be ruled out. It has urged all affected individuals to remain vigilant, review their credit reports and financial statements on a regular basis and report suspicious activity to relevant law enforcement authorities and financial institutions without delay.

 

The college is also offering a year of complimentary identity protection and credit monitoring services via Experian Identity Works to all the individuals affected by the incident.

 

On April 28, 2023, a group of threat actors going by the name Avos Locker claimed responsibility for the cyber attack on Emmanuel College and listed it as a victim on its data leak site. 

 

According to screenshots shared by Databreaches, the group claimed to be in possession of 140GB of data stolen from the college’s internal network. Avos Locker also shared a few old employee W-2 files from 2014 And 2017 to support its claims.

 

In December last year, Massachusetts-based Bunker Hill Community College also filed a data security incident notice with the Maine Attorney General, confirming that a cyber attack in May compromised the sensitive personal information of at least 195,588 individuals.

 

The compromised data included the names, dates of birth, Social Security Numbers, driver’s license numbers, state identification numbers, U.S. alien identification numbers, passport numbers, financial account numbers in combination with routing numbers, credit and debit card numbers, usernames and passwords, medical information, and health insurance information.