MSU Students Could Lose Data in MOVEit Data Breaches
Table of Contents
- By Steven
- Published: Aug 03, 2023
- Last Updated: Aug 03, 2023
Michigan State University is a large school located in East Lansing, Michigan. This public university has more than 49,000 students per semester and is set over a location spread across 5,300 acres. The university caters to hundreds of thousands of students over time, many of whom may have been exposed due to a recent data breach. The breach wasn't on the university itself, but it likely impacted many of the students attending Michigan State.
How Did the Attack Occur?
The Michigan State University data breach was part of a larger MOVEit file transfer service breach chain. The breach was actually on the National Student Clearinghouse and impacted many other major universities. The breach was possible because of a security vulnerability in the MOVEit file transfer tool. Any company with databases connected to MOVEit was at risk of being hacked and having that data taken. Attackers were able to freely access all the data connected to MOVEit by using this exploit that the company has since patched. Students that attended Michigan State University were notified if they were at risk of losing data to the breach.
What Information Was Viewed or Stolen?
The National Student Clearinghouse gathers information from students to verify them before they are enrolled in school. The organization collects personal information such as Social Security numbers, first and last names, home addresses, email, phone numbers, and much more. All of this data could be available to the attackers that harvested data from the students.
How Did Michigan State University Admit to the Breach?
The university sent emails out to students that may be at risk, informing them that their data could have been lost in a recent data breach. The moment the university received information from the National Student Clearinghouse, that data was passed on to students of the school. It's unclear if the school made any public announcements or filed any documents in connection with this data breach, but official forms are unlikely since the breach occurred in the National Student Clearinghouse instead of the university itself.
What Will Become of the Stolen Information?
The C10P ransomware gang behind the MOVEit data breaches is using the stolen data to demand ransoms from different organizations. It's unlikely that the National Student Clearinghouse will pay any ransom, so student data will end up spread across the internet, resold to attackers, and leveraged in identity theft attacks. If your data was stolen in this breach, you should expect it to be misused by the gang behind this breach.
What Should Affected Parties Do in the Aftermath of the Breach?
If you receive a notice informing you that your data may have been exposed in this recent breach, you should immediately check your credit report at each major credit bureau. You can also freeze your credit to prevent hackers from using it to open new accounts in your name. It's unclear whether free credit monitoring services will be given out or not, but you could also invest in credit monitoring to watch your credit closely for long-term protection.
