The Chronicle of Higher Education, Inc.

The Chronicle of Higher Education, Inc. disclosed that unauthorized parties exploited a vulnerability in one of its servers, exposing account information (name, email, username, and plain-text passwords) for some online accounts to chronicle.com, philanthropy.com, and chroniclevitae.com. The breach occurred on June 15, 2020, and was discovered on June 19, 2020. The company reset all passwords, replaced the affected server, and strengthened security hashing/salting procedures.

The Chronicle of Higher Education, Inc. disclosed that unauthorized parties exploited a server vulnerability to obtain administrative credentials and accessed a database containing hashed and salted passwords for online accounts on February 17, 2020. The incident was discovered on May 10, 2020, after an internal alert. The company took the server offline, engaged forensic investigators, and notified law enforcement. Affected users were prompted to change passwords, and the company implemented stronger hashing technology and replaced the affected server.

THE CHRONICLE OF HIGHER EDUCATION INC filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-256). The register records the breach as discovered on June 15, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

THE CHRONICLE OF HIGHER EDUCATION INC filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-199). The register records the breach as discovered on May 10, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.