The Colorado Department of Higher Education (CDHE) recently notified the University of Colorado of a cybersecurity incident that may involve the personal information of certain CU community members.
On June 19, 2023, CDHE became aware it was the victim of a cybersecurity ransomware incident that impacted its network systems. CDHE took steps to secure the network and has been working with third-party specialists to conduct a thorough investigation into this incident. CDHE also worked to restore systems and return to normal operations.
While this incident is still part of an ongoing criminal and internal investigation, CDHE does know an unauthorized actor(s) accessed its systems between June 11 and June 19, 2023, and that certain data was copied during this time. Over the past few weeks, CDHE’s investigation has revealed that, although it varies by individual, impacted records may include names, social security numbers, student ID numbers and other education records. Individuals who attended a public institution of higher education in Colorado between 2007-2020, attended a Colorado public high school between 2004-2020, individuals with a Colorado K-12 public school educator license between 2010-2014, participated in the Dependent Tuition Assistance Program from 2009-2013, participated in Colorado Department of Education’s Adult Education Initiatives programs between 2013-2017, or obtained a GED between 2007-2011 may be impacted by this incident.
CDHE’s review of the impacted records is ongoing and once complete, it will notify individuals who are potentially impacted by mail or email provided it has individuals' contact information. If you fall into the categories outlined above, we encourage you to sign up for CDHE's complimentary access to credit monitoring and identity theft protection services through Experian regardless of whether CDHE notifies you.
What CDHE Is Doing.
In response to this incident, CDHE is reviewing its policies and procedures and is working to implement additional cybersecurity security safeguards to further protect its systems. Additionally, CDHE is providing impacted individuals with complimentary access to credit monitoring and identity theft protection services through Experian. Although CDHE is making these services available to impacted individuals, CDHE is unable to enroll individuals directly due to privacy reasons.
What You Can Do.
Remain vigilant against incidents of identity theft and fraud. Review your account statements and free credit reports for suspicious activity and errors. If you are impacted, we encourage you to enroll in the monitoring services CDHE is offering.
For More Information.
For assistance with questions regarding this incident, please visit https://cdhe.colorado.gov/notice-of-data-incident or call CDHE’s designated hotline at (833) 301-1346, 7 a.m. to 9 p.m. Mountain Time, Monday through Friday, and 9 a.m. to 6 p.m. Mountain Time, Saturday and Sunday (excluding U.S. holidays).
We encourage you to remain vigilant against incidents of identity theft and fraud by reviewing your credit reports/account statements for suspicious activity and to detect errors. Under U.S. law, you are entitled to one free credit report annually from each of the three major credit reporting bureaus, TransUnion, Experian, and Equifax. To order your free credit report, visit annualcreditreport.com or call 1-877-322-8228. Once you receive your credit report, review it for discrepancies and identify any accounts you did not open or inquiries from creditors that you did not authorize. If you have questions or notice incorrect information, contact the credit reporting bureau.
You have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any of the three credit reporting bureaus listed below.
As an alternative to a fraud alert, you have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without your express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a credit freeze may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a credit freeze on your credit report.
Should you wish to place a fraud alert or credit freeze, please contact the three major credit reporting bureaus listed below:
We will continue to update the CU community on further developments.
Freqently Asked Questions
What occurred with this cybersecurity incident?
On June 19, 2023, CDHE became aware it was the victim of a cybersecurity ransomware incident that impacted its network systems. CDHE took steps to secure the network and has been working with third-party specialists to conduct a thorough investigation into this incident. CDHE also worked to restore systems and return to normal operations. While the incident is still being investigated, CDHE learned that unauthorized actor(s) accessed its systems and copied certain data
Were University of Colorado systems impacted?
This cybersecurity incident did not impact CU systems or networks.
How will I know if I am impacted by the CDHE cybersecurity incident?
If your personal data was impacted, you will be contacted by CDHE via email or mail to the extent CDHE has your contact information. CDHE is also offering those impacted complimentary access to credit monitoring and identity theft protection through Experian. Although CDHE is making these services available to impacted individuals, CDHE is unable to enroll individuals directly due to privacy reasons.
If you fall into the following categories, however, we encourage you to sign up for CDHE’s complimentary credit monitoring and identity theft protection services, regardless of whether you are notified by CDHE:
- You attended a public institution of higher education in Colorado between 2007-2020.
- You attended a Colorado public high school between 2004-2020.
- You held a Colorado K-12 public school educator license between 2010-2014.
- You participated in the Dependent Tuition Assistance Program from 2009-2013.
- You participated in the Colorado Department of Education’s Adult Education Initiatives programs between 2013-2017.
- You obtained a GED between 2007-2011.
What can I do to protect myself and my family?
- To learn more about proactive steps you can take to protect your identity, visit https://www.identitytheft.gov/databreach.
- We also encourage you to remain vigilant against incidents of identity theft and fraud by reviewing your credit reports/account statements for suspicious activity and to detect errors. Under U.S. law, you are entitled to one free credit report annually from each of the three major credit reporting bureaus, TransUnion, Experian, and Equifax. To order your free credit report, visit annualcreditreport.com or call 1-877-322-8228.
- You have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert lasting seven years.
- You also have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without your express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in your name without your consent.