Bunker Hill Community College Provides Notice of Security Incident

BOSTON, Dec. 29, 2023 /PRNewswire/ -- Bunker Hill Community College ("BHCC") experienced a data incident in May 2023 (the "Incident") that potentially involved certain individuals' personal information ("Information"). This notice provides information about this Incident, BHCC's response, and where individuals can direct further questions.

What Happened?

On May 23, 2023, BHCC detected irregular activity on certain BHCC systems that was consistent with a ransomware attack. BHCC immediately responded to the situation by taking the affected systems offline, contacting law enforcement, and engaging data security and privacy experts to conduct an investigation. BHCC personnel were able to stop the unauthorized activity from spreading and contained the Incident to a limited number of BHCC systems. BHCC's backups were not affected by the Incident, and BHCC personnel were able to restore BHCC's network from those backups without any data loss. As a credit to the existing safeguards that BHCC had in place, BHCC personnel successfully and safely restored BHCC's network, enabling BHCC to continue with its academic calendar without any delay.

BHCC engaged leading data security professionals to support its investigation and response. BHCC's investigation has found that an unauthorized actor gained access to BHCC's network before deploying ransomware. The investigation was also able to confirm that a limited amount of data was copied from BHCC's network. Accordingly, BHCC reviewed the relevant data to determine whether any personal information was present so it could notify individuals as appropriate. There is currently no indication that the unauthorized actor has misused any Information for identity theft or fraud in connection with this Incident.

What Information Was Involved?

BHCC's investigation determined that the following general categories of Information may have been involved in the Incident but are not relevant to every individual: name, date of birth, Social Security Number, driver's license number, state identification number, U.S. alien identification number, passport number, financial account number in combination with routing number or code, credit/debit card number, username and password, medical information, and health insurance information. Again, the circumstances are different for each individual and not every category applies to each individual.

What BHCC is Doing.

Upon becoming aware of the unauthorized activity, BHCC immediately implemented measures to further improve the security of BHCC's information technology systems and practices, including resetting and strengthening passwords, implementing new network security tools, and adopting new network access policies. BHCC worked with leading cybersecurity experts to aid in their investigation and response, and BHCC reported this incident to relevant government agencies and law enforcement. 

Additionally, BHCC is offering free credit monitoring services to potentially affected individuals for 24 months through Experian, which includes Credit Monitoring, Fraud Consultation, and Identity Theft Restoration.

What Individuals Can Do.

BHCC encourages potentially affected individuals to remain vigilant against incidents of identity theft and fraud by reviewing their account statements and monitoring their free credit reports for suspicious activity and to detect errors. Potentially affected individuals can also enroll in the credit monitoring services that BHCC is offering at no cost.

Potentially affected individuals seeking additional information, including whether their Information was involved and their eligibility for complimentary credit monitoring, may call BHCC's toll-free assistance line at 888-722-9207, Monday through Friday, 9 AM to 9 PM Eastern time. Individuals may also contact BHCC at [email protected].

Other Important Information

Under U.S. law, individuals are entitled to 1 free credit report annually from each of the 3 major credit reporting bureaus. To obtain a free credit report, individuals may visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. Alternatively, affected individuals can contact the 3 major credit reporting bureaus directly at the addresses below. 

Moreover, information regarding identity theft, fraud alerts, security freezes, and the steps an individual can take to protect personal information may be obtained by contacting the consumer reporting agencies, the Federal Trade Commission, or the appropriate state Attorney General. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. Individuals can obtain further Information on how to file such a complaint by calling 1-877-438-4338. Individuals should file a police report if they are a victim of identity theft or fraud. To file a report with law enforcement for identity theft, an individual will likely need to provide some proof that they have been a victim.

If you have questions regarding this matter, you can contact (888) 722-9207.

SOURCE Bunker Hill Community College