National Student Clearinghouse
Disclosed Jun 29, 2023Confirmed
MOVEit breach at student records nonprofit affects 890 schools
The National Student Clearinghouse said attackers accessed its MOVEit server on May 30, 2023 and stole files with student names, birth dates, Social Security numbers, student IDs and enrollment and degree records; 890 schools were affected and a Maine filing listed over 51,500 people.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Jun 29, 2023 |
| Discovered | Jun 20, 2023 |
| Happened | May 30, 2023 |
| Attack | Supply chain |
| Data exposed | NamesDates of birthAddressesSocial Security numbersEducation records |
| Sector | Education · US |
| Status | Confirmed |
| Part of | Moveit (2023) |
Sources
California Attorney General breach notice: National Student ClearinghouseWashington Attorney General breach notice: National Student ClearinghouseNotice letter filed with the Delaware DOJ: National Student ClearinghouseOregon DOJ breach notice: National Student ClearinghouseCalifornia AG breach notice: National Student ClearinghouseNational Student Clearinghouse data breach impacts 890 schools
Notices filed
Same campaign
History of this record
empty to moveit-2023by seedSource
hacking to supply-chainby seedSource
["names"] to ["names","dob","addresses","ssn","education"]by seedSource
2023-08-30 to 2023-06-29by seedSource
empty to The National Student Clearinghouse said attackers accessed its MOVEit server on May 30, 2023 and stole files with student names, birth dates, Social Security numbers, student IDs and enrollment and degree records; 890 schools were affected by seedSource
empty to MOVEit breach at student records nonprofit affects 890 schoolsby seedSource
[] to ["names"]by backfillSource
2023-09-21 to 2023-08-30by backfillSource
unknown to hackingby backfillSource
empty to 2023-06-20by backfillSource
2023-12-12 to 2023-09-21by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.