310,000 Records Compromised In University Of Colorado Data Breach

Data accessed in the breach includes grades and transcript data, visa and disability status, medical and prescription information and in limited cases, Social Security numbers and university financial account information.

Video Transcript

JIM BENEMANN: Tonight, we're learning more about a massive data breach that compromised a lot of records at the University of Colorado. Today, the university announced more than 310,000 school records were compromised. Records including grades, transcripts, student visa and disability status, also medical and prescription information, and some social security numbers. The attack targeted what should be a secure file transfer system managed by a company called Accellion.

Here's a timeline of the attacks. CU was notified in January 25, immediately suspended Accellion's service. At that point, CU determine 447 school users were at risk of unauthorized access. Well, the university was able to restore the service on the 28th using a software patch, essentially a quick repair job. Then on February 9, the school announced it was investigating what it believed to be the largest cyber attack ever against the school. And by March 1, as you see, Accellion said all known transfer vulnerabilities were corrected. And as recently as the 23rd of March, school saying it was still investigating the scope of the attack.

Well, now both the university and individuals are being asked to pay a ransom to keep all that information private. Andrea Flores on the story tonight. Andrea, the university says it's not gonna pay a ransom. And neither should anyone else.

ANDREA FLORES: That's what they were saying, Jim. And CU is doubling down on security measures after that data breach. It affected both CU Boulder and CU Denver. And with more than 70,000 students and 40,000 employees across the entire system, they're educating people on how to make sure their personal information is secure.

- I guess if my data had been hacked, I'd call my dad. [LAUGHS]

ANDREA FLORES: Holly McCullough and Anna Bajaj are freshman at CU Boulder. They're on high alert after the university sent out an email to students and staff about a possible data breach.

- It just said that there was a big security breach and that there would be-- if you were affected, then you'd be getting a second email.

ANDREA FLORES: CU Vice President of Communications Ken McConnellogue says at least 310,000 records with personal data have been compromised.

KEN MCCONNELLOGUE: And that vendor let us know that they were the victim of a cyber attack. What we've also learned is they are now trying to extort both the university and individuals.

ANDREA FLORES: There are steps students and staff can take to stay safe.

KEN MCCONNELLOGUE: So what we're doing is notifying all of those who are involved in this and providing them with some credit monitoring, identity monitoring. We're asking people just to simply not respond.

ANDREA FLORES: For these CU Boulder students, the breach has them thinking twice about sharing personal information.

- It is more just scary that, like, this idea that this could happen in a different circumstance too.

ANDREA FLORES: CU has moved all personal information to a different platform. And they're working on those measures with students and staff and everyone across that school system. But they did want to mention in this day and age with people sharing their data online that there's only so much you can do when it comes to cyber attacks. Reporting live tonight in Denver, I'm Andrea Flores covering Colorado first.