The Colorado Department of Higher Education has revealed that it suffered a ransomware attack that exposed 16 years worth of student data.

The CDHE became aware of the incident on June 19, 2023, and has been working with experts to understand the scope of the breach and return to normal operation. In the course of the investigation, the CDHE says data from a 16-year period was copied:

While this incident is still part of an ongoing criminal and internal investigation, we do know that an unauthorized actor(s) accessed CDHE systems between June 11 and June 19, 2023 and that certain data was copied from CDHE systems during this time. Over the past few weeks, our investigation has revealed that some of the impacted records include names and social security numbers or student identification numbers, as well as other education records.

The review of the impacted records is ongoing and once complete, CDHE will be notifying individuals who are potentially impacted by mail or email to the extent we have contact information. While the review is ongoing, those that attended a public institution of higher education in Colorado between 2007-2020, attended a Colorado public high school between 2004-2020, individuals with a Colorado K-12 public school educator license between 2010-2014, participated in the Dependent Tuition Assistance Program from 2009-2013, participated in Colorado Department of Education’s Adult Education Initiatives programs between 2013-2017, or obtained a GED between 2007-2011 may be impacted by this incident.

The CDHE is reviewing its policies and security measures in an effort to prevent future breaches, and is also providing impacted individuals with credit and identity theft monitoring services via Experian.