The Colorado Department of Higher Education (CDHE) disclosed on August 4, 2023, that it has suffered a large-scale data breach following a ransomware attack that occurred on June 19, 2023. In their Notice of Data Incident, CDHE explained that an unauthorized actor accessed their systems between June 11 and June 19, 2023, and exfiltrated data that spans sixteen (16) years. CDHE noted that an investigation into the impact of the data breach is still ongoing but specified various types of individuals that may be impacted. The impacted individuals include those who “attended a public institution of higher education in Colorado from 2007-2020, attended a Colorado public high school between 2004-2020, individuals with a Colorado K-12 public school educator license between 2010-2014, participated in the Dependent Tuition Assistance Program from 2009-2013, participated in Colorado Department of Education’s Adult Education Initiatives programs between 2013-2017, or obtained a GED between 2007-2011.” CDHE stated that some of the impacted data contains names, Social Security numbers (SSNs), student identification numbers, and other education records. Bleeping Computer, on August 5, 2023, claimed that exfiltrated data actually contained the following information: “full names, social security numbers, dates of birth, addresses, proof of addresses (statements/bills), photocopies of government IDs, and for some, police reports or complaints regarding identity theft.” CDHE stated that notifications will be sent through mail or email to those impacted by the data breach once the investigation has completed. CTIX analysts will continue to monitor the CDHE data breach and provide updates on the conclusion of the investigation as well as fallout when applicable.