Fireworks Software breach exposed data tied to Rowan College at Burlington County

Fireworks Software, a vendor supplying customer relationship management and record keeping systems to higher education institutions, disclosed in September 2024 that an intruder had reached files on its network containing data supplied by Rowan College at Burlington County in New Jersey.

The company said unauthorized access occurred between June 23 and June 26, 2024. It reported concluding on August 28, 2024 that personal information stored on its systems may have been accessed or copied, although one law firm tracking the case placed the discovery date in late June. Notification letters were mailed on September 17, 2024, and filings were made with the attorneys general of Maine and Massachusetts.

Reported totals put the number of affected people at 27,404, of whom seven were Maine residents and 29 were Massachusetts residents. Accounts of the exposed data differ. State filings and legal trackers variously listed names, dates of birth, Social Security numbers and alien registration numbers, with some reports adding addresses, government identification numbers and financial details. The notification letter itself was criticised for not specifying what had been taken.

A proposed class action, Adamek v. Fireworks Software, was filed on September 27, 2024 in federal court in Pennsylvania. It alleged that the data had been stored unencrypted and that the notice sent to victims was deficient.