Virginia Union University says data breach impacted students' sensitive personal information

Virginia Union University said it experienced a data security incident that involved unauthorised access to certain systems that stored sensitive personal information of staff and students.

 

In a recent notice of data breach filed with the Office of California Attorney General and a notice of data security incident on its website, Virginia Union University (VUU) said that on February 13, it detected unauthorised access in its internal network. The University immediately launched an investigation, with assistance from third party cyber security experts, to determine the nature and scope of the incident.

 

“VUU discovered on April 1, 2024, that certain impacted files containing personal information may have been subject to unauthorised access or acquisition in connection with this incident,” reads the notice.

 

The compromised data included full names, Social Security Numbers, dates of birth, driver’s license numbers and State IDs. VUU is, however, yet to comment on how many individuals were affected by the data security incident.

 

“VUU remains fully committed to maintaining the privacy of personal information in its possession and has taken many precautions to safeguard it, including continually evaluating and modifying its practices and internal controls,” the University added.

 

While VUU found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered complimentary identity protection and credit monitoring services through CyEx’s Identity Defence to all affected individuals.

 

On February 21, the LockBit ransomware group claimed responsibility for the cyber attack on VUU and listed the University as a victim on its data leaks site. The group gave VUU a deadline of March 10 to meet its ransom demands, failing which it threatened to publish the stolen data.