Dear CU Community Members,
Recently, a few of CU’s vendors notified CU that they were impacted by the global cyberattack against the MOVEit Transfer software owned by Progress Software. What is currently known is that the cyberattack involves data for some in the CU community and includes prospective students, students, current employees and former employees. The cyberattack involved the following vendors:
- National Student Clearinghouse (NSC). NSC provides educational reporting and research services to many higher education institutions. NSC used the MOVEit Transfer software and has indicated that CU student data was impacted. For more information visit: https://alert.studentclearinghouse.org/
- TIAA and Pension Benefit Information (PBI). TIAA, CU’s retirement plan recordkeeper, uses PBI to assist TIAA in death claim and beneficiary processes. PBI used the MOVEit Transfer software and has indicated that some CU participant data was impacted. For more information visit: https://www.pbinfo.com/faq-consumer/
- United Health Care Student Resources (UHCSR). UHCSR provided student health insurance to CU Anschutz Medical Campus students and provides student health insurance to CU Denver international students. UHCSR used the MOVEit Transfer software and has indicated that data from CU students who enrolled in the UHCSR health insurance plan was impacted. For more information visit: www.uhcsr.com/media/dbd8af76-4e09-4bd1-b94c-eb94a4b4fdc6
Due to the nature of the software and how it was used by our vendors, individuals are unlikely at this time to know whether their personal data were impacted. If your personal data is included in the exposure, you will be notified in the near future. To take proactive steps to protect your identity, learn more about actions you can take at https://www.identitytheft.gov/databreach.
Although this cyberattack happened to third-party vendors, it is a reminder of the importance of cybersecurity at CU. If you have questions about keeping data safe, please contact your campus/system administration information security office (https://www.cu.edu/security/about).
We also encourage you to remain vigilant against incidents of identity theft and fraud by reviewing your credit reports/account statements for suspicious activity and to detect errors. Under U.S. law, you are entitled to one free credit report annually from each of the three major credit reporting bureaus, TransUnion, Experian, and Equifax. To order your free credit report, visit annualcreditreport.com or call 1-877-322-8228. Once you receive your credit report, review it for discrepancies and identify any accounts you did not open or inquiries from creditors that you did not authorize. If you have questions or notice incorrect information, contact the credit reporting bureau.
You have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any of the three credit reporting bureaus listed below.
As an alternative to a fraud alert, you have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without your express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a credit freeze may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a credit freeze on your credit report.
Should you wish to place a fraud alert or credit freeze, please contact the three major credit reporting bureaus listed below:
We will continue to update the CU community on further developments.