Over the past few weeks, multiple colleges and universities have posted notices on their respective websites regarding a National Student Clearinghouse (“NSC”) data breach. Evidently, the NSC data breach involves the organization’s use of MOVEit, a file transfer program that contained a previously unknown vulnerability allowing hackers to access data stored within the program. In these notices, the colleges and universities explain that, as a result of the NSC / MOVEit data breach, an unauthorized party was able to access students’ sensitive information. While NSC is still investigating the incident, once the company determines who was affected, it will begin sending out data breach notification letters to all affected parties.
If you are a student of UB University at Buffalo, Bates Technical College, Colorado State University, SUNY Freedonia or St. Petersburg College and you receive a data breach notification from National Student Clearinghouse, it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the National Student Clearinghouse data breach. For more information, please see our recent piece on the topic here.
What Caused the National Student Clearinghouse Breach?
The National Student Clearinghouse data breach was only recently announced, and more information is expected in the near future. However, NSC’s recent post entitled “MOVEit Security Issue Update” provides some important information on what led up to the breaches. According to this source, NSC uses a popular file transfer program called MOVEit.
MOVEit is a product of Progress Software. On May 31, 2023, Progress Software announced a zero-day vulnerability within MOVEit that allowed hackers to access information stored on various organizations’ MOVEit servers, including NSC’s.
Once NSC was informed of the vulnerability, it reported the incident to law enforcement and then launched an investigation with the help of third-party data security specialists. The NSC investigation confirmed that an unauthorized party obtained certain files transferred through NSC’s MOVEit environment, including files containing data that NSC maintains on behalf of certain colleges. The following colleges were recently notified by NSC that their students’ data was among that which was compromised:
- Bates Technical College,
- Lake Sumter Community College,
- UB University at Buffalo,
- SUNY Freedonia,
- Colorado State University,
- Olympic College, and
- St. Petersburg College.
After learning that sensitive consumer data was accessible to an unauthorized party, National Student Clearinghouse began to review the compromised files to determine what information was leaked and which consumers were impacted. NSC is still in the process of reviewing the affected data types and identifying which students were affected.
Once the National Student Clearinghouse completes its investigation, it will send out data breach letters to anyone who was affected by the recent data security incident.
Why Does the National Student Clearinghouse Have Students’ Confidential Information?
The National Student Clearinghouse is an organization that provides educational reporting, data exchange, and verification services to over 3,600 colleges and universities nationwide. To allow NSC to perform these services, colleges and universities must provide NSC with students’ confidential information.
More Information About National Student Clearinghouse
Founded in 1993, National Student Clearinghouse is an education verification and student educational outcomes research organization based in Herdon, Virginia. The organization oversees 97 percent of students enrolled in public and private higher education institutions and 70 percent of students enrolled in public and private high schools. National Student Clearinghouse employs more than 300 people and generates approximately $28 million in annual revenue.
