Michigan State University data breach linked to global ransomware attack

EAST LANSING — A data breach linked to Michigan State University vendors was part of a global ransomware attack that may have affected 30 million Americans, according to a Wednesday statement from the state's Attorney General's Office.

"This was a global data breach that has reached over 500 entities and into the personal information of over 30 million Americans, and now it is confirmed to have crept onto campus at MSU," Attorney General Dana Nessel said in a statement. "These kinds of attacks are becoming more common and wider reaching, and the broad community of MSU students, staff and retirees should take very seriously any indication that their data was stolen. Any Michigan resident who believes their information might have been compromised or that they are the victims of identity theft can contact the consumer protection team in my office."

The data breach for MSU is linked to National Student Clearinghouse and the Teachers Insurance and Annuity Association of America. Those are two large vendors used by many other universities.

The data was exposed by a foreign-based ransomware group known as Clop that exploited a security flaw in the MOVEit Transfer software, according to the Michigan Attorney General Dana Nessel's office.

The organizations, such as MSU or its vendors, were not directly contacted but blackmail demands were posted instructing victims to contact the data thieves, according to the statement.

Michigan State University previously disclosed the breach in a notice to students and others. It is not clear how many people linked to MSU had their data exposed.

The overarching data breach has been public for several months. In July, the U.S. Cybersecurity and Infrastructure Security said it was providing support to various federal agencies "that have experienced intrusions," Eric Goldstein, executive assistant director for cybersecurity, said in a release.

Goldstein said the intrusions affected the agency's MOVEit file transfer software, which encrypts files and uses secure File Transfer Protocols (FTPs), automation and analysis to transfer large volumes of data.

Michigan residents have been exposed to several major data breaches recently, including more than 757,000 people exposed through Lansing Community College, 168,215 people through a recent Henry Ford Health data breach, 156,713 people exposed at Hope College and at Flagstar Bank, based in Troy, which is dealing with a late 2021 data breach that affected more than 1.4 million people, according to regulators.

Data breaches are on track to break records nationally and internationally this year too, said James Lee, the chief operating officer of Identity Theft Resource Center.

The MOVEit data breach is still unfolding with new victims being discovered, he said.

"We’ve been tracking data breaches since 2005," Lee said. "This year, unless by some miracle all data breaches stop, we will set an all-time high. We're already 85% of the way to the current high record number so the question is not if, but when and how far will we exceed it."

Here are some tips from MSU spokesman Mark Bullion to help protect yourself from data breaches:

• Be aware of the possibility of phishing emails. There are a wide variety of ways that a hacker can use something authentic looking to trick you. Some clues include giving you a sense of urgency, misspellings or emails that aren't quite right (like a "1" instead of a lower case "l").

• Create effective passwords. Don't use the same password or a simple variation of the same one. Change passwords regularly. Avoid using your name, letter replacements (an asterick instead of an "o") or common sequences (like asdfg or 12345). Try instead using passphrases, which are short sentences integrated with numbers and special characters instead of a one- or two-word password.

• Use multifactor authentication on devices and accounts when possible. Most of MSU's logins require this, Bullion said.

• Do not maintain data or files that are no longer needed.

• Get a free credit report annually, those can be gotten by visiting annualcreditreport.com or by calling 877-322-8228.

Businesses should invest in cybersecurity and take steps to regularly monitor commercial credit reports, bank records and state regulatory filings as well as take other steps to make sure imposters aren't stealing information, said Daniel Wimmer, a spokesperson for Michigan Attorney General Dana Nessel.

Contact Mike Ellis at mellis@lsj.com or 517-267-0415

This article originally appeared on Lansing State Journal: Michigan State data breach linked to global ransomware attack