American International College yesterday notified 11,822 people of a November 2023 data breach that compromised their names and Social Security numbers.
Ransomware group nSafe claimed responsibility for the attack in January 2024, saying it stole 5,000 GB of data. According to the notification, the breach was discovered on December 3, 2023, but AIC didn’t determine that potentially impacted data contained information about victims until April 8, 2024.
American International College has not confirmed nSafe’s claim. We don’t yet know whether any systems were encrypted, how attackers breached AIC’s systems, how much ransom was demanded, or if AIC plans to pay the ransom.
Comparitech contacted AIC for comment, and will update this article if it responds.
The notification reads:
“The investigation […] determined that there was unauthorized access to our environment between November 14, 2023 and December 3, 2023. The investigation also determined that an unauthorized actor had the ability to access or take certain information stored on the network during this period of time. […] On April 8, 2024, AIC determined the potentially impacted data contained certain information related to you.”
Victims could be at risk of identity fraud. Comparitech recommends victims take advantage of the free credit monitoring offered by AIC via Experian, and to monitor credit reports and financial accounts for suspicious activity.
Who is nSafe?
A relatively new ransomware group that emerged this year, nSafe has claimed three attacks that were not confirmed by targets. American International College is nSafe’s first confirmed ransomware victim.
Ransomware attacks on US education
In 2023, Comparitech logged 102 confirmed ransomware attacks on the education sector in the US, a big increase on the 72 attacks in 2022. The attacks in 2023 affected 2,017,053 individual records. The average ransom was $450,000.
So far this year we’ve tracked 12 confirmed attacks on the US education sector. They include Virginia Union University, Camino Nuevo Charter Academy, Lee University, and Traverse City Area Schools.
In addition to data theft, ransomware attacks can cripple key systems, forcing schools to cancel classes and pay high recovery costs. In 2022, we noted an average downtime of 11.65 days.
About American International College
American International College is a private university in Springfield, Massachussetts established in 1885. Undergraduate and graduate enrollment consists of about 2,000 students.