Colorado Department of Higher Education breach exposed 16 years of records

The Colorado Department of Higher Education disclosed in early August 2023 that a ransomware attack in June had exposed personal records covering nearly two decades of students, educators and other Coloradans.

The department said an unauthorized actor was inside its network between June 11 and June 19, 2023, when the intrusion was discovered, and copied data during that period.

The affected groups were unusually broad. In an updated notice the department widened them to include anyone who attended a Colorado public high school between 2004 and the 2021-22 school year, anyone enrolled at a Colorado public institution of higher education between 2007 and 2020, anyone enrolled in a Federal TRIO program in Colorado before 2017, holders of a Colorado K-12 educator license between 2010 and 2014, participants in the Dependent Tuition Assistance Program from 2009 to 2013, participants in Adult Education Initiatives programs between 2013 and 2017, and people who took a GED exam in Colorado before 2012.

Records taken could include full names, Social Security numbers, student identification numbers, dates of birth, addresses, proof of address documents, photocopies of government identification and, in some cases, police reports relating to identity theft complaints.

The department said it secured its network, engaged third party specialists and worked to restore systems. It offered 24 months of credit monitoring and identity theft protection to affected individuals. It did not publish a victim count, and no ransomware group publicly claimed the attack.