The Board of Governors of the Colorado State University System

The Board of Governors of the Colorado State University System reported a data breach to the Montana Attorney General. The breach was reported on 2024-09-05. The breach occurred from 8/14/2024 to 8/15/2024. 10 Montana residents were affected.

Colorado State University – Pueblo reported a phishing incident on August 14, 2024, where an employee was targeted by a social engineering attack impersonating the university controller. The employee sent an unprotected Excel spreadsheet containing student information (names, SSNs, DOBs, etc.) to an unauthorized third party. The breach was discovered on August 15, 2024. A total of 11,079 individuals were affected, including 4 New Hampshire residents. The university notified affected individuals electronically on August 18, 2024, and implemented additional employee cybersecurity training.

The Board of Governors of the Colorado State University System (CSU) notified the New Hampshire Attorney General of a security event involving third-party vendors Pension Benefits Information, LLC (PBI) and the National Student Clearinghouse (NSC). The Clop threat actor exploited a zero-day vulnerability in Progress Software's MOVEit Transfer software to exfiltrate data. While CSU's own systems were not directly impacted, 19,344 individuals whose data was held by vendors on behalf of CSU were affected, including 37 New Hampshire residents. CSU issued community notices and vendors provided two years of complimentary credit monitoring through Kroll.

The Board of Governors of the Colorado State University System reported a data breach to the Montana Attorney General. The breach was reported on 2023-08-16. The breach occurred from 5/29/2023 to 5/30/2023. 92 Montana residents were affected.