The University of Colorado (UC) has disclosed that a serious cyberattack on its software likely compromised the personal data of students, faculty, and staff members.
University President Mark Kennedy announced on Tuesday that the data breach targeted vulnerabilities in the file sharing software provided by California-based cloud solutions company Accellion and that it was “the largest, most complex incident involving data” that the school system has experienced.
The corrupted computer program was used to transfer potentially sensitive files such as health and clinical records, research datasets, and personally identifiable information which is protected by privacy laws.
After conducting a forensic investigation, the university said that the attack mainly jeopardized data from CU Boulder and CU Denver. The Anschutz and Colorado Springs campuses, as well as system administration, were apparently unaffected.
The Accellion service was terminated on January 25 following orders from the Office of Information Technology since it was also used for security purposes. UC Vice President of Communications Ken McConnellogue said, “Yes part of it is to handle secure files and that makes it doubly disappointing that sensitive data was able to be accessed out there.”
He believes that the recent security violation will exceed “a similar attack in 2005 that exposed about 50,000 records.” The university reached out to around 450 individuals whose files were in the system after they were notified of the breach.
“As we notify them we want to provide as much information to them as possible, which is why this forensic stage that we’re in is important and will take a little time,” McConnellogue said.
Further investigation is underway to identify the extent of the breach and determine the perpetrator behind the cyberattack. Accellion spokesperson Rob Dougherty said the company is also assessing the situation.
“We will share more information once this assessment is complete. For their protection, we do not comment on specific customers. We are working with all impacted FTA clients to understand and mitigate any impact of this incident,” he said.