Stetson University stetson.edu Stetson University data breach: what happened and what to do
Stetson University reported a 2020 breach, linked to a ransomware attack on a third-party vendor, that affected 79,247 people in total. The breach ran from February 7 to May 20, 2020 and involved Social Security numbers.
View all 13,177 breaches- Breach date
- 7 Feb 2020
- Made public
- 2 Oct 2020
- Affected
- 79,247
- Data exposed
- Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Stetson University, a private university in DeLand, Florida, told state regulators about a data breach in the fall of 2020. A filing with the Maine Attorney General puts the breach period at February 7 to May 20, 2020. Stetson discovered it on September 4, 2020 and sent written notices on October 2, 2020. The California Attorney General's breach list shows the university's notice with a report date of November 3, 2020.
The filing ties the incident to a ransomware attack on a third-party service provider and attaches a notice labeled as Blackbaud's. Blackbaud, a software vendor to schools and nonprofits, had a ransomware attack in 2020 that hit many of its customers, and Stetson was one of them.
Sources checked: maine.gov, oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
How many people and what was exposed
The Maine filing lists 79,247 people affected in total, including 210 Maine residents. It says Social Security numbers were involved. The filing doesn't give a full list of data types, so treat other fields as unconfirmed.
What that lets criminals do
A Social Security number is the key piece for identity theft: new credit cards, loans or phone contracts opened in your name, or a fake tax return filed to take your refund. These attempts can show up months or years after a breach.
The company's response
Stetson offered 12 months of complimentary Experian credit monitoring to people whose Social Security numbers were involved.
What to do if you were in it
- 1
Freeze your credit
If your Social Security number was in your notice, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how.
- 2
Use the free credit monitoring if you got an offer
Stetson offered 12 months of Experian monitoring. The FTC recommends taking free protection a company offers after a breach, but monitoring alerts you, it doesn't block new accounts.
- 3
Check your credit reports
Get your free reports at annualcreditreport.com and look for accounts you don't recognize.
- 4
Watch for scams that mention the breach
Don't click links in messages about the breach or your account. Go to the university's website yourself.
- 5
Report identity theft if it happens
If someone uses your details, report it at IdentityTheft.gov. You can also run a free Serus scan to check which breaches include your email or phone.
Official filings
- California Attorney General , filed 3 Nov 2020
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Stetson University breach?
Stetson sent written notices on October 2, 2020 to the people affected. If you didn't get one, contact the university to ask.
What was exposed?
The Maine Attorney General filing says Social Security numbers were involved. It doesn't list other data types.
How many people were affected?
The Maine filing lists 79,247 people in total, including 210 Maine residents.
Was this Stetson's own systems?
The filing links the incident to a ransomware attack on a third-party service provider, and the attached notice is labeled as Blackbaud's.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
