Saint Xavier University says 2023 cyber attack impacted over 200,000 individuals

Saint Xavier University, a Chicago-based Roman Catholic university, said that the data security incident it suffered last year compromised the sensitive personal information of more than 210,000 individuals.

 

In a data breach notice filed with the Office of Maine Attorney General, Saint Xavier University (SXU) said that on July 21, 2023, it identified suspicious activity in its internal network. University authorities immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The investigation determined that an unauthorised actor downloaded certain files stored on limited SXU systems between June 29 and July 18, 2023,” the university said.

 

The compromised data included names, dates of birth, Social Security numbers, driver’s license or state identification card numbers, passport information, financial account information, medical information, biometric information, health insurance information, student identification numbers, payment card information, and account access information.

 

Saint Xavier University’s filing with the Maine state regulator also revealed that at least 212,267 individuals were impacted by the incident.

 

“Upon first learning of the activity, we quickly responded, and have been working diligently to provide you with an accurate and complete notice. We also promptly notified federal law enforcement, and we also provided relevant updates to the SXU community as we worked to respond to this matter,” the University added.

 

SXU has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through IDX to all affected individuals.

 

In August last year, the ALPHV/BlackCat ransomware group claimed responsibility for the cyber attack on SXU and listed it as a victim on its data leak site. The group claimed to be in possession of more than 1 TB of data stolen from the University and shared screenshots of the stolen data to prove the authenticity of its claims.