Colorado Education Department Suffers Ransomware Breach

Former and current high school staff and students in Colorado have been put on notice that their personal information may have been compromised, after a serious ransomware breach at a state government agency.

Colorado Department of Higher Education (CDHE) revealed the news in a breach notification on Friday. It became aware of the breach on June 19 and has been working with third-party experts on incident response, including forensics and restoration of affected systems.

“While this incident is still part of an ongoing criminal and internal investigation, CDHE knows that an unauthorized actor(s) accessed CDHE systems between June 11 and June 19, 2023 and that certain data was copied from CDHE systems during this time,” it explained.

“Over the past few weeks, the investigation has revealed that some of the impacted records include names and social security numbers or student identification numbers, as well as other education records.”

Read more on ransomware breaches: Education Sector Has Highest Share of Ransomware Victims

A potentially sizeable number of people have been affected. The CDHE said this includes anyone who attended public higher education in Colorado between 2007 and 2020, or a public high school between 2004 and 2020.

Also at risk are those holding a Colorado K-12 public school educator license between 2010 and 2014, people who participated in the Dependent Tuition Assistance Program from 2009 to 2013, or the Colorado Department of Education’s Adult Education Initiatives programs between 2013 and 2017, or obtained a GED between 2007 and 2011.

“In response to this incident, CDHE is reviewing its policies and procedures and working to implement additional cybersecurity safeguards to further protect its systems. Additionally, CDHE is providing impacted individuals with complimentary access to credit monitoring and identity theft protection services through Experian for two years,” the breach notification statement continued.

“Remain vigilant against incidents of identity theft and fraud. Individuals should review account statements and monitor free credit reports to detect suspicious activity and errors. CDHE encourages impacted individuals to enroll in credit monitoring services through Experian.”