University System of Georgia says MOVEit Transfer breach compromised students' personal data

University System of Georgia said it experienced a significant data breach as a result of the Clop ransomware group exploiting a zero-day vulnerability in the MOVEit Transfer web application.

University System of Georgia is a unified higher education system in the U.S. state of Georgia and is composed of 26 higher education institutions including four research universities, four comprehensive universities, nine state universities and nine state colleges.

In a notice posted on its website last week, USG said that it used Progress Software’s MOVEit Transfer application to send and receive files securely. Like several other organisations globally, USG also suffered a data security incident following the exploitation of a zero-day vulnerability in the software in May last year.

“As has now been widely reported, the MOVEit software included a vulnerability that allowed cybercriminals unauthorised access to the files stored on the MOVEit platform at numerous governments, higher education, and corporate customer sites worldwide beginning on or about May 28, 2023. This included USG,” it said.

According to investigations conducted by the Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA), sensitive personal information of individuals associated with USG was stolen in the data breach. The compromised data included Social Security Numbers, dates of birth, bank account numbers and federal income tax documents with Tax ID numbers.

USG added that immediately after being notified about the data security incident, the affected MOVEit Transfer software was blocked on May 31 and security patches, that were released by Progress Software, were applied to secure the application and avoid such incidents in the future.

USG is offering one year of complimentary credit monitoring and identity theft protection services through Experian IdentityWorks to all the individuals affected by the data breach, but is yet to announce how many people had their data compromised as a result of the security incident.