Third-party data breach impacts EvCC community

Updated: July 31 and Sept. 13, 2023
Release Date: July 25, 2023

What happened?

According to national news media reports, many businesses and organizations worldwide have been impacted by a May 2023 cybersecurity incident related to a widely used file sharing application known as MOVEit Transfer.

Everett Community College does not use the MOVEit software and none of our systems were impacted by the data breach.

However, two third-party service providers notified EvCC that personally identifiable information from some students and employees may have been exposed. The service providers are the National Student Clearinghouse (NSC) and the Teachers Insurance and Annuity Association (TIAA).

How can I tell if my personal information was obtained by an unathorized party? What happens next?

Students/Alumni 

NSC told EvCC on Aug. 14 that they believe there were two groups whose information was compromised in the breach: 

• Group 1 (fewer than five students and alumni): Data could have included name, date of birth, student ID number and transcript data (grades and classes attended). Data varies by individual. NSC promises to directly contact this group and provide two years of free credit monitoring. EvCC will also notify this group directly.
• Group 2 (9,075 students and alumni): Data included name only.
• NSC has told EvCC that they do not believe any EvCC student or alumni social security numbers were compromised.

Employees

If you are an EvCC employee enrolled in TIAA and your data was included in this data breach, you will receive notification from the State Board for Community and Technical College’s Human Resources department the week of July 31 either by email or by U.S. mail. Pension Benefit Information (PBI) LLC, the vendor that works with TIAA and had data compromised in the breach, will also contact you with more information and to offer 24 months of credit monitoring at no cost to you. If you have questions, please reach out to PBI at 866-373-9043.

EvCC has asked for a list of names or a number of impacted employees, but SBCTC HR says they are unable to provide that information because the list provided by PBI/TIAA of impacted individuals is not broken down by college.

If you are enrolled in Department of Retirement Systems (PERS and TRS) plans, your employee data was not impacted. This includes classified staff, some exempt staff, and some faculty members.

What do I need to do to protect myself?

The Federal Trade Commission offers recommendations if you think your personal information has been compromised. These include: 

Closely monitor your credit reports.

You can obtain a free copy of your credit report from each of the three major credit reporting agencies; Equifax, Experian, and TransUnion.

Place a fraud alert on your accounts.

A fraud alert tells creditors to contact you before opening any new accounts or before making changes to existing accounts. You can place a fraud alert by contacting one of the three credit reporting agencies. A fraud alert at one of the agencies will automatically notify the other two services.

Freeze your credit at each of the three major credit reporting agencies.

If you believe you are the victim of identity theft, file a police report and notify the Federal Trade Commission.

Block electronic access to your Social Security information.

Contact the Social Security Administration at 1-800-772-1213 to block electronic access. This will prevent anyone from being able to see or change your personal information on the internet or by the administration’s automated telephone service.

What is MOVEit? 

A popular file sharing application known as MOVEit Transfer is used by hundreds of businesses and organizations worldwide. 

What is the National Student Clearinghouse?

The National Student Clearinghouse is a nonprofit organization that provides educational reporting, data exchange, and verification services to more than 3,600 colleges and universities nationwide. EvCC provides personally identifiable information and student education records to NSC as part of this work. Additional details about the incident are available on NSC’s website.

What is Teachers Insurance and Annuity Association?

TIAA offers financial services to employees across the country working in academic, research, medical, government and cultural fields. EvCC provides TIAA with personally identifiable information of employees who enroll in the state board retirement plan. TIAA notified the college that EvCC employee data used by Pension Benefit Information, LLC, one of its vendors, has been impacted. If you are enrolled in Department of Retirement Systems (PERS and TRS) plans, your employee data was not impacted. This includes classified staff and some exempt staff.

Can I change my retirement plan? 

No. This is not an event that would allow for a retirement plan change.