Cyberattack may have compromised data of students who attended Colorado’s public high schools, colleges

The Colorado Department of Higher Education announced Friday that a cybersecurity breach may have resulted in the theft of personal information from anyone who attended a public high school, college or university in the state over a period of more than a decade leading up to 2020.

Teachers licensed by the state and people who obtained GEDs also may have been impacted by the breach, officials said.

The department learned on June 19 that an “unauthorized actor” accessed its systems between June 11 and 19 and copied certain data, including names and Social Security numbers or student identification numbers, as well as other education records.

Potential impacted victims include anyone who:

• Attended a public college or university in Colorado between 2007 and 2020
• Attended a Colorado public high school between 2004 and 2020
• Held a Colorado K-12 education license between 2010 and 2014
• Participated in the state’s Dependent Tuition Assistance Program from 2009 to 2013
• Participated in the Colorado Department of Education’s Adult Education Initiatives between 2013 to 2017
• Obtained a GED in Colorado between 2007 to 2011

Department officials on Friday told The Denver Post they were “unable to share” an estimate of the total number of people who might be impacted by the breach.

“CDHE took steps to secure the network and has been working with third-party specialists to conduct a thorough investigation into this incident,” department officials said in a release.

The incident remains part of an ongoing criminal and internal investigation, the department said.

The Colorado Department of Higher Education will notify potentially impacted people by mail or email, if officials have contact information.

In response to the incident, the department said it is reviewing policies and procedures and adding more cybersecurity safeguards.