Loading story…
Hackers accessed up to 16 years of Colorado public school student data during a June ransomware attack on the Colorado Department of Higher Education, exposing records tied to students and educators across the state. Reporting said the compromised information included sensitive education data held by the department, making the incident one of the more significant state education-sector breaches in Colorado.
Colorado officials later faced scrutiny for failing to promptly disclose the breach, with reporting indicating the department did not notify affected people and the public as quickly as expected after discovering the intrusion. The delayed disclosure raised concerns about compliance with breach-notification obligations and about how state agencies communicate cyber incidents involving long-retained student records.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
In October 2023, reporting highlighted that the Colorado higher education department had failed to promptly disclose the data breach, drawing attention to delays in notifying affected parties and the public. This marked a governance and response issue beyond the initial intrusion itself.
By August 2023, officials publicly reported that hackers had accessed extensive Colorado public school student data during the June attack, including records spanning roughly 16 years. The disclosure established the breadth of the incident's impact on student information.
In June 2023, the Colorado Department of Higher Education was hit by a ransomware attack that compromised systems holding public school data. Reporting said attackers accessed up to 16 years of student information.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
statescoop.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A breach tied to **PowerSchool**, a widely used K-12 software provider, exposed student and teacher information from school districts across the U.S., including New Jersey districts where officials said data on students and educators was stolen in a nationwide cyberattack. Reporting on the incident said the compromise affected records held by schools using the platform, raising concerns about the scale of exposure across the education sector and the security of sensitive K-12 data. Separately, **Spring Lake Park Schools** in Minnesota canceled classes and shut down technology systems after an outside actor gained unauthorized access to district networks in what officials described as a suspected ransomware incident. The disruption affected classes, child care, community education, and after-school programs, while the district worked with third-party cybersecurity experts, state law enforcement, and the **FBI** to contain the intrusion and restore operations; officials later said classes would resume and that they had no evidence at that point that personal information had been affected.
Jun 29, 2026
The Identity Theft Resource Center (ITRC) reported a record **3,322** data breaches in the US last year, while noting that roughly **70% of breach notices lacked key incident details**, limiting defenders’ ability to understand scope, root cause, and affected data. The reporting gap was attributed to inconsistent state breach-notification laws and uneven enforcement; while all states and several US territories require some form of consumer notification for certain PII exposures, only **34 states** require breach reporting to state agencies. The ITRC also cited the **PowerSchool** incident as the largest US cyber incident of the year. Separately, Blue Cross Blue Shield of Montana (BCBSMT) disclosed that up to **462,000** members may have been affected by a “cyber incident” at third-party vendor **Conduent**, and the matter is now trending toward litigation over whether the Montana State Auditor has authority to investigate under a new state breach-reporting law effective **Oct. 1, 2025**. BCBSMT argues the incident pre-dated the law’s effective date and that its notification to the auditor was a courtesy, while reporting also noted the apparent absence (as of publication) of a corresponding entry from BCBSMT or Conduent on the US HHS public HIPAA breach portal. A separate blog post about a purported “**16 billion leaked credentials**” compilation describes an aggregated infostealer-driven credential corpus rather than a single breach and does not materially relate to the US breach-notification transparency and enforcement issues described above.
Jun 29, 2026
The University of Hawaiʻi Cancer Center confirmed a **ransomware-driven data breach** affecting its epidemiology division, with the potential exposure of data tied to up to **1.2 million individuals**. The university reported that attackers accessed files containing **SSNs and driver’s license numbers** sourced from historical Hawaiʻi DOT records and Honolulu voter registration data (dating back to 1998), as well as health-related research data connected to the **Multiethnic Cohort (MEC) Study** and other diet-and-cancer studies; the incident was discovered on **August 31, 2025**, and the university acknowledged it engaged with the threat actors while restoration and impact assessment were underway. Separately, a “cyber incident” caused a **five-school-day internet outage** at the Denmark School District in Wisconsin; the **INC Ransom** group claimed the victim on its leak site, alleging both **encryption** and theft of roughly **70.76 GB** of data, though the district had not publicly confirmed ransomware or data exfiltration. In the healthcare sector, **Insight Hospital and Medical Center** in Chicago reported unauthorized network access between **August 22 and September 11, 2025**, and the **Termite** group later claimed to have stolen and then **leaked ~360 GB** (about 900,000 files) of “confidential data,” including medical imaging files (e.g., `.dcm`), raising the likelihood of exposure of both identity data and protected health information.
Jun 29, 2026