The Board of Governors of the Colorado State University System

Colorado State University – Pueblo notified affected individuals of a cybersecurity incident on August 14, 2024. Employees were targeted by a social engineering attack, resulting in unauthorized access to an unprotected Excel spreadsheet containing student names, ID numbers, and billing balances. No university systems were breached. The incident was limited in scope.

Colorado State University – Pueblo reported a phishing incident on August 14, 2024, where an employee was targeted by a social engineering attack impersonating the university controller. The employee sent an unprotected Excel spreadsheet containing student information (names, SSNs, DOBs, etc.) to an unauthorized third party. The breach was discovered on August 15, 2024. A total of 11,079 individuals were affected, including 4 New Hampshire residents. The university notified affected individuals electronically on August 18, 2024, and implemented additional employee cybersecurity training.

The Board of Governors of the Colorado State University System (CSU) notified the New Hampshire Attorney General of a security event involving third-party vendors Pension Benefits Information, LLC (PBI) and the National Student Clearinghouse (NSC). The Clop threat actor exploited a zero-day vulnerability in Progress Software's MOVEit Transfer software to exfiltrate data. While CSU's own systems were not directly impacted, 19,344 individuals whose data was held by vendors on behalf of CSU were affected, including 37 New Hampshire residents. CSU issued community notices and vendors provided two years of complimentary credit monitoring through Kroll.

The Colorado State University System (CSU) notified Montana regulators of a security event involving third-party vendors Pension Benefits Information (PBI) and the National Student Clearinghouse (NSC). The Russian threat actor Clop exploited a zero-day vulnerability in Progress Software's MOVEit Transfer software to exfiltrate data including names and Social Security numbers. While CSU's own systems were not directly affected, 19,344 individuals whose data was held by vendors on behalf of CSU were impacted, including 92 Montana residents. CSU and vendors are providing two years of credit monitoring.