HackingEducationEducationVulnerability ExploitCapture Stored DataClopZero-DayData ExfiltratedRansom DemandedSupply Chain (3P Vendor)TargetedCustomer Data InvolvedIdentity (basic)Government IDHighContained

The Board of Governors of the Colorado State University System

bd_442e2ef79000f25c · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 10, 2023

Filed

Aug 17, 2023

To disclose

5 weeks

Affected · nationwide

19,34437 in this filing

Linked

2 filings

Confidence

66%

Full breach record for The Board of Governors of the Colorado State University System →

The Board of Governors of the Colorado State University System (CSU) notified the New Hampshire Attorney General of a security event involving third-party vendors Pension Benefits Information, LLC (PBI) and the National Student Clearinghouse (NSC). The Clop threat actor exploited a zero-day vulnerability in Progress Software's MOVEit Transfer software to exfiltrate data. While CSU's own systems were not directly impacted, 19,344 individuals whose data was held by vendors on behalf of CSU were affected, including 37 New Hampshire residents. CSU issued community notices and vendors provided two years of complimentary credit monitoring through Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 42 days

discovery → filing · 5 weeks / 38 days

May 29, 2023

Begins

Jul 10, 2023

Discovered

Aug 14, 2023

Scope determined

Aug 17, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGClopbd_d5be50961858899d2023-08-16 · +1dCandidate

Name: The Board of Governors of the Colorado State University System
norm: the board of governors of the colorado state university system
Domain: csusystem.edu

Name: The Board of Governors of the Colorado State University System
norm: the board of governors of the colorado state university system
Domain: csusystem.edu
Industry: Educationllm

Discovered: Jul 10, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 42 daysoccurrence → discovery
Materiality determined: Aug 14, 2023
Notification sent: Aug 17, 2023
Affected individuals: 19,344state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain· Clop
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: ClopExternalFinancial
Regulator citations: Providing written notice of this security event to relevant state regulators
Initial access: exploit_public_facing

During the incident: Launched an investigation to determine the scope and effect of the disclosed security event
Issued a notice to its community members to provide as much information as possible and provide guidance on how to better protect against identity theft and fraud via a website
Providing written notice of this security event to relevant state regulators
PBI and NSC promptly began applying available patching
Undertaking the recommended mitigation steps
Notified relevant law enforcement agencies
Launched internal investigations with the assistance of third-party cybersecurity specialists
Notified the consumer reporting agencies, Equifax, Experian, and TransUnion
Providing access to credit monitoring and identity theft restoration services, through Kroll, for two (2) years to individuals whose personal information was potentially affected by this security event, at no cost to these individuals
Established a toll-free call center for notified individuals to address any questions they may have related to the security event
Changes made: PBI and NSC are reviewing and enhancing their information security policies and procedures
CSU and its vendors are reviewing their policies, procedures, and cybersecurity safeguards to further protect their systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGAug 16 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/board-governors-colorado-state-university-system-20230817.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2023
Raw hash: e97f4c972fb727e68442d6f0b10f08d35bf372218c11fe1b9c1d544729b0565f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityThe Board of Governors of the Colorado State University System

Victim entityThe Board of Governors of the Colorado State University System

Incidentdiscovered Jul 10, 2023

Stated responseLaunched an investigation to determine the scope and effect of the disclosed security event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov