Jessica Gould reports:
The New York City Department of Education estimates that the personal data of some 45,000 students was compromised as part of a breach involving the file transfer software MOVEit.
Officials said the compromised data includes social security numbers, birth dates and certain student evaluations, though the specific types of data breached varies per student. Employees’ information was also affected, officials said, but they did not identify how many staff members were involved. No education department data has been published as a result of the breach so far, officials said, and the department will begin notifying those affected this summer.
Read more at Gothamist.
As Gould noted, multiple federal agencies and many companies were also affected by the breach orchestrated by Clop threat actors. One of the victims was the National Student Clearinghouse (NSC), a nonprofit and nongovernmental organization that provides educational reporting, data exchange, verification, and research services.
NSC has provided updates to its customers about updating and securing data involved in the MOVEit breach. What it hasn’t done, however, is come clean with its customers about what data Clop acquired and whether NSC has paid Clop’s extortion demand or is negotiating to pay any demand.
What DataBreaches can report is that NSC was listed on Clop’s leak site and then its name was removed on June 20. Why was it removed? Did Clop decide to be kind to them, or did NSC pay them or talk to them about payment?
After being contacted by a concerned individual who shared NSC’s emailed updates with DataBreaches, DataBreaches sent an email inquiry to NSC’s media office yesterday office yesterday morning asking them to provide simple “yes” or “no” answers to two questions:
1. Has the clearinghouse or any affiliated entity paid extortion to Clop for them to remove data from their leak site?
2. If there has been no payment, then is the clearinghouse or any representative negotiating or trying to negotiate with Clop to remove the data from their leak site?
There has been no reply as of publication. This post will be updated if a reply is received.