Bunker Hill Community College says May data breach impacted close to 200,000 individuals

Massachusetts-based Bunker Hill Community College suffered a significant ransomware attack that compromised the sensitive personal information of almost 200,000 individuals.

The news of the cyber security incident first came to light when the college, in a press release on its website on August 18, said that it suffered a cyber attack in May 2023. The college authorities immediately launched an internal investigation with assistance from third party cyber security experts and notified relevant law enforcement authorities about the same.

To mitigate the risk of the ransomware attack, Bunker Hill Community College also took all the affected systems offline. BHCC added that its backups were not affected by the incident and BHCC personnel were able to restore the affected network from those backups without any data loss.

In a recent filing with the Office of the Maine Attorney General, BHCC said its investigation revealed that before deploying the malware into its network, the threat actor gained access to BHCC’s network and exfiltrated a limited amount of data.

The compromised data included the names, dates of birth, Social Security Numbers, driver’s license numbers, state identification numbers, U.S. alien identification numbers, passport numbers, financial account numbers in combination with routing numbers, credit and debit card numbers, usernames and passwords, medical information, and health insurance information. The filing with the state regulator also revealed that at least 195,588 individuals were impacted by the incident.

“Upon becoming aware of the unauthorised activity, BHCC immediately implemented measures to further improve the security of BHCC’s information technology systems and practices, including resetting and strengthening passwords, implementing new network security tools, and adopting new network access policies,” BHCC said in its press release.

While the college added that it did not find any evidence of the compromised information being misused, the possibility for the same cant be ruled out. It has urged all affected individuals to remain vigilant and report suspicious transactions to relevant law enforcement authorities and financial institutions.

BHCC is offering two years of complimentary credit monitoring, fraud consultation, and identity theft restoration services through Experian to all the individuals affected by the data security incident.

The notorious Snatch ransomware group claimed responsibility for the ransomware attack on Bunker Hill Community College in June last year and listed it as a victim on its data leak site. The hackers did not reveal the amount of ransom they demanded from the college or how long they gave the college to pay a ransom.