The University of Utah is monitoring three related nationwide data breaches traced back to MOVEit Transfer, a file transfer software used by third-party contractors.

U Advancement records were exposed through software used by TIAA Kaspick. Human Resources benefits records may have been exposed through TIAA’s third-party vendor contract. And student records managed by the University Registrar through the National Student Clearinghouse, a software system for verifying degrees and enrollment, may also have been compromised.

On June 29, a third-party vendor for University of Utah Advancement reported a data breach involving donor records. TIAA Kaspick alerted U advancement leaders about the security breach, which occurred at the end of May. Approximately 30 planned/legacy giving donors to the University of Utah were impacted. Personal information including their names, birthdates and Social Security numbers were exposed. No other information was compromised. All impacted donors or their representatives have been notified, and the vendor is offering free credit monitoring for two years to each of the individuals impacted. At this time, no fraudulent activity related to the breach has been reported.

TIAA notified University Human Resources on July 7 that data—including dates of birth and Social Security numbers—for more than 13,800 current and former employees may have been exposed. Human Resources is working with TIAA and will communicate with impacted employees as more information becomes available. The affected individuals also will receive information directly from TIAA and their vendor partner.

The University Registrar is working with its third-party vendor to determine how many student records may have been impacted. Other state colleges and universities and the Utah System of Higher Education are assessing the digital breach. Read the USHE student notice here: https://ushe.edu/nsc-data-student-notice/.

This story will be updated as more information becomes available.