iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
The University System of Georgia (USG) has revealed the cyber attack it suffered last year affected 800,000 people.
The USG reported last year that it was affected by the major MOVEit transfer supply chain attack that occurred back in May 2023, being one of the first organisations known to have been compromised.
For context, the MOVEit data breach refers to the cyber attack on the MOVEit Secure File Transfer software developed by Progress Software, which is used by organisations worldwide.
In May 2023, Russian ransomware gang Clop discovered and leveraged a zero-day flaw in the software, allowing it to access the software’s systems and access data belonging to companies and government agencies using the software.
Affected organisations included PwC, the University of Sydney, Deloitte, US Defence and Justice agencies, Shell, Medibank, BBC, British Airways, and more.
The USG, which is a US government agency, operates 26 public universities and colleges across the state of Georgia, dealing with over 340,000 students collectively.
Now, the USG has begun notifying 800,000 people affected by the breach, informing them of what happened.
According to the notification letter, dated 15 April 2024, data exfiltrated as a result of the breach included full or partial (last four digits) Social Security numbers, bank account numbers, dates of birth, and federal income tax documents with tax ID numbers.
“USG takes protecting personal information seriously and is taking steps to prevent a similar occurrence in the future,” said the breach notification.
“MOVEit® Transfer software operating at USG was immediately blocked upon detection of the breach on May 31, 2023 and has now been fully updated and secured in accordance with guidance from Progress® Software and CISA.
“After updating and securing the system, USG immediately began a lengthy investigation to determine which individuals may have been impacted by the incident.”
According to Clop’s dark web leak site, the threat group posted the entirety of the USG’s data “via torrent”. It did not publish the date that this occurred.
Be the first to hear the latest developments in the cyber industry.
