Decades of records belonging to Colorado students could be at risk following a massive data breach at the state’s Department of Higher Education.

Officials are continuing to investigate a cybersecurity ransomware incident that occurred between June 11 and June 19, exposing students’ names, social security numbers, student identification numbers and other education records, CDHE announced in a news release Friday.

The department has already begun notifying potentially impacted individuals by mail or email “to the extent CDHE has contact information.” As the investigation continues, CDHE encourages potential victims to sign up for complimentary two-year credit monitoring and identity theft protection services through Experian. Specifics on this protection measure can be found at cdhe.colorado.gov/notice-of-data-incident. Enrollment for these services ends Nov. 30.

ACLU sues Woodland Park School Board, district

The following groups are potentially at risk:

• Those who attended a public institution of higher education in Colorado between 2007-2020.
• Those who attended a Colorado public high school between 2004-2020.
• Those who held a Colorado K-12 public school educator license between 2010-2014.
• Those who participated in the Dependent Tuition Assistance Program from 2009-2013.
• Those who participated in Colorado Department of Education’s Adult Education Initiatives programs between 2013-2017.
• Those who obtained a GED between 2007-2011.

Meet Susana Córdova, Colorado’s new education commissioner

CDHE is working with third-party specialists to investigate this breach. The department is also “reviewing its policies and procedures and working to implement additional cybersecurity safeguards to further protect its systems,” according to the news release. The department declined to comment on the incident .

Those who fall into the at-risk groups should “remain vigilant against incidents of identity theft and fraud” and “review account statements and monitor free credit reports to detect suspicious activity and errors.”

CDHE attributes the delay between the incident and notifying the greater public to “gathering information and following statute.”

“Since first learning of the incident, CDHE has been working diligently to gather information about the incident from its investigation and determine what information may have been affected. Based on such efforts, CDHE is providing notice, via email, letter, and its website, as soon as it is reasonably able to do so and consistent with Colorado law and the required timeframe,” a spokesperson stated via email.

For questions, CDHE has a hotline at 833-301-1346 between 7 a.m. and 9 p.m. Monday through Friday and 9 a.m. and 6 p.m. Saturday and Sunday.

Academy School District 20 returns disputed materials to library shelves, pledges to follow policy for future removals