Cyber Incident Victim: Connecticut Higher Education Trust
Date:
Jun 2018
Location:
United States of America
Summary
A security breach at the Connecticut Higher Education Trust resulted in nearly $1 million stolen from its accounts, impacting 21 account holders. The program manager, TIAA-CREF Tuition Financing, alerted the state Treasury to the incident and committed to fully restoring the affected accounts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In June 2018, the Connecticut Higher Education Trust (CHET) experienced a security breach resulting in the theft of nearly $1 million from its accounts. The breach impacted 21 CHET account holders, as confirmed by Connecticut State Treasurer Denise Nappier’s office. TIAA-CREF Tuition Financing, Inc., the program manager for CHET Direct, detected the incident and notified the Connecticut Treasury Department about unauthorized access and fund withdrawals. The theft represented a direct financial compromise of individual education savings accounts within the state-sponsored 529 college savings plan. No specific details regarding the breach methodology or intrusion timeline were disclosed in public statements. TIAA-CREF immediately assumed responsibility for financial remediation upon discovering the incident.
The breach caused no permanent financial loss to affected accountholders due to TIAA-CREF’s commitment to fully restore all stolen funds. Treasurer Nappier’s announcement emphasized that restitution would occur without specifying whether additional protective measures were implemented for other accounts. The incident exposed vulnerabilities in CHET’s financial infrastructure but did not trigger public disclosures about systemic security upgrades. Impact was confined to monetary theft without evidence of broader data compromise involving personal information. TIAA-CREF’s role as program manager placed accountability for both breach detection and financial recovery squarely with the vendor. The Treasury Department’s public confirmation served as primary notification to affected parties, with no reports of subsequent legal actions or regulatory penalties emerging from available records.