University of Colorado cu.edu University of Colorado data breach: what happened and what to do
Attackers exploited a flaw in the Accellion file transfer service the University of Colorado used, and CU was told on January 25, 2021. CU's analysis found more than 310,000 unique records with varying personal information. The attackers posted data online after CU refused to pay.
View all 13,177 breaches- Breach date
- Jan 2021
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The University of Colorado used Accellion, a third-party file transfer service. Attackers exploited a vulnerability in that software, and Accellion notified CU of the incident on January 25, 2021. CU shut the service down in January.
CU says most of the data came from CU Boulder, with some from Denver. The Colorado Springs and Anschutz campuses were not affected.
Sources checked: cu.edu, atg.wa.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
CU's forensic analysis found more than 310,000 unique records, not all of them separate people. Depending on the person, they included grades and transcript data, student ID numbers, race and ethnicity, veteran, visa and disability status, and limited donor information. A smaller group had medical details, and in limited cases Social Security numbers.
The extortion
The group behind the attack posted small amounts of data online and threatened to release more. CU said it would not pay, following FBI guidance. After the group posted more CU files, CU found additional affected data and began notifying more people by mail or email on July 1, 2021.
What it means
For most people the data is educational and personal rather than financial. The risk is phishing that uses your real academic details. For the smaller group with Social Security numbers, identity theft is the concern. Your notice says which group you were in.
What to do if you were in it
- 1
Read your notice for what applied to you
CU's letters say which kinds of data were involved. Match your next steps to that.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops anyone opening new credit in your name. Place one at Equifax, Experian and TransUnion; the FTC explains how. Do this if your notice mentions a Social Security number.
- 3
Expect phishing that mentions the breach
Expect messages that quote your courses, grades or student ID. Don't click links or call numbers in unexpected messages. Go to the company's own website instead, and report scams at ReportFraud.ftc.gov.
- 4
Protect your accounts
Change passwords you reused with your university login and turn on two-factor login. CU later moved to a different transfer platform, but older credentials may still be out there.
- 5
Report misuse and watch your reports
Check your credit reports at annualcreditreport.com. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
Official filings
- Washington Attorney General , filed 13 Apr 2021 : 3,511 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the CU breach?
CU notified people by mail or email, in spring 2021 and again from July 1, 2021. If you received a notice, you were affected.
How many people were affected?
CU reports more than 310,000 unique records. That is records, not a count of separate people.
Did CU pay the attackers?
No. CU said it followed FBI guidance and did not pay.
What was exposed?
Mostly education records and personal details. A smaller group had medical information, and in limited cases Social Security numbers.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
