The Connecticut Office of the State Treasurer announced that hackers stole rougly $1 million from the Connecticut Higher Education Trust (CHET), a state-sponsored college savings plan.
CHET is a 529 plan, in which citizens set aside money to save for steep college tuition costs. Only 21 customers were harmed by the security breach, whom Tuition Financing, Inc. will reimburse for their losses. However, the fact that a state-sponsored account got hacked raises many red flags around the city’s overall security.
After an investigation, TFI found that no other plans were hacked. At this point, they do not know the source of the hack or who caused the breach, but they reported that the hackers did not receive any personal information from the CHET website or from TFI. The thieves must have had information about the account holders from an outside source.
TFI first reported the security breach to Treasurer Denise Nappier, who asserted,
I am deeply concerned that these criminal activities have impacted CHET account holders. Until it happens to you, it’s hard to capture how unsettling it is when personal accounts have been compromised. I’ve been there. Every owner of the more than 150,000 CHET accounts can and should expect our vigilance and best efforts to ensure that their funds and information are protected.
The treasury department later said in a statement:
CHET account data and online systems are housed at and maintained by TFI and its service providers. TFI has implemented system enhancements, additional internal controls, and extra manual reviews aimed at helping to protect against future fraudulent activity. The Treasury is closely monitoring these security initiatives. In addition, we have requested an independent audit of fraudulent account activity and an independent review of TFI’s cyber, telephone and manual security programs.
No further information about the hack exists yet, but TFI will likely never let this happen again. If it does, it will lose the faith of its account holders.
Featured image via Pixabay/JavadR
