University of Utah

The University of Utah experienced multiple data breaches in 2023, involving sensitive information of students, employees, donors, and health plan members due to vulnerabilities in third-party vendor systems.

Donor and Employee Data Breach

On June 29, 2023, TIAA Kaspick, a third-party vendor for the University of Utah Advancement, reported a data breach involving donor records. This incident was part of a series of breaches related to the MOVEit file transfer software vulnerability. The breaches affected approximately 30 donors and 13,800 current and former employees, compromising names, Social Security numbers, and dates of birth[1][3].

Health Plan Members Data Breach

Another breach impacted the University of Utah Health Plans, affecting 3,914 plan members. This breach was discovered on June 21, 2023, with unauthorized access occurring between May 30 and June 2, 2023. The compromised information included members’ names, mailing addresses, email addresses, phone numbers, dates of birth, Social Security Numbers, medical claims information, banking information, billing information, and/or medical treatment information. The breach was associated with TMG Health, a vendor using the MOVEit server. The University of Utah Health Plans responded by offering one year of complimentary personal identity and privacy protection monitoring to the affected members[2][5][6].

Ransomware Attack

In a separate incident in 2020, the University of Utah paid $457,000 to prevent ransomware operators from leaking stolen data. This attack targeted computing servers in the College of Social and Behavioral Science, leading to the encryption of data and theft of employee and student information. The university took measures to prevent the release of information on the internet, with the ransom partially covered by its cyber insurance policy. This incident highlighted a specific vulnerability that was subsequently addressed to enhance data security[4].

Response and Recommendations

The University of Utah has taken steps to address these breaches, including notifying affected individuals, offering identity protection services, and working with law enforcement. The incidents have prompted the university to improve its cybersecurity measures, such as moving systems with private and restricted data to more secure environments and implementing stronger authentication methods[2][3][4].

For individuals affected by these breaches, it is recommended to monitor financial statements, change online passwords, and consider placing fraud alerts or credit freezes on credit files to protect against identity theft[8].

Citations:

1. https://attheu.utah.edu/facultystaff/university-of-utah-statement-moveit-vendor-data-breaches/
2. https://www.ksl.com/article/50708165/data-breach-may-have-affected-almost-4000-university-of-utah-health-plan-members
3. https://www.jdsupra.com/legalnews/the-university-of-utah-announces-three-7040191/
4. https://www.bitdefender.com/blog/hotforsecurity/university-of-utah-paid-457000-to-prevent-ransomware-operators-from-leaking-stolen-data/
5. https://kslnewsradio.com/2028685/data-breach-at-university-of-utah-health-plans-could-impact-members/
6. https://kutv.com/news/local/u-of-u-health-investigates-data-security-breach-potentially-involving-member-information-university-of-utah-doctor-hospital-healthcare-school
7. https://www.idtheftcenter.org/post/university-of-utah-health-data-breach-exposes-patient-health-information/
8. https://ksltv.com/568667/a-massive-global-cyberattack-has-reached-utah-so-how-can-you-protect-your-identity/