HackingEducationEducationVulnerability ExploitCapture Stored DataClopZero-DayData ExfiltratedSupply Chain (3P Vendor)TargetedRansom DemandedIdentity (basic)Government IDHighContained

The Board of Governors of the Colorado State University System

bd_d5be50961858899d · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 10, 2023

Filed

Aug 16, 2023

To disclose

5 weeks

Affected · nationwide

19,34492 in this filing

Linked

2 filings

Confidence

67%

Full breach record for The Board of Governors of the Colorado State University System →

The Colorado State University System (CSU) notified Montana regulators of a security event involving third-party vendors Pension Benefits Information (PBI) and the National Student Clearinghouse (NSC). The Russian threat actor Clop exploited a zero-day vulnerability in Progress Software's MOVEit Transfer software to exfiltrate data including names and Social Security numbers. While CSU's own systems were not directly affected, 19,344 individuals whose data was held by vendors on behalf of CSU were impacted, including 92 Montana residents. CSU and vendors are providing two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 42 days

discovery → filing · 5 weeks / 37 days

May 29, 2023

Begins

Jul 10, 2023

Discovered

Aug 16, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGClopbd_442e2ef79000f25c2023-08-17 · +1dVerified

Name: The Board of Governors of the Colorado State University System
norm: the board of governors of the colorado state university system
Domain: csusystem.edu

Name: The Board of Governors of the Colorado State University System
norm: the board of governors of the colorado state university system
Domain: csusystem.edu
Industry: Educationllm

Discovered: Jul 10, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 42 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 16, 2023
Affected individuals: 19,344state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain· Clop
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: ClopExternalFinancial
Regulator citations: Provided written notice to relevant state regulators
Initial access: exploit_public_facing

During the incident: Launched investigation to determine scope and effect
Issued notice to community members via website
Provided written notice to relevant state regulators
PBI and NSC applied available patching
PBI and NSC notified relevant law enforcement agencies
PBI and NSC launched internal investigations with third-party cybersecurity specialists
PBI and NSC notified consumer reporting agencies
PBI and NSC providing access to credit monitoring and identity theft restoration services through Kroll for two years
Established a toll-free call center for notified individuals
Changes made: Reviewing and enhancing information security policies and procedures
Reviewing policies, procedures, and cybersecurity safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGAug 16 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-565.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 16, 2023
Raw hash: e6abf0273d33fa5332e5d4208f38e73a0c4dd44d623e91f844b153e5eb1078fe

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityThe Board of Governors of the Colorado State University System

Victim entityThe Board of Governors of the Colorado State University System

Incidentdiscovered Jul 10, 2023

Stated responseLaunched investigation to determine scope and effect

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov