Hackers breached 21 Connecticut Higher Education Trust (CHET) accounts and withdrew $1.4 million, according to Connecticut’s State Treasurer Denise Nappier.
Nappier said her office received word of the breach from the TIAA-CREF Tuition Financing Inc. (TFI), which is CHET Direct’s program manager. CHET Direct is a 529 college savings plan with more than $3.6 billion in assets under management and approximately 150,000 accounts.
TFI maintains and houses CHET’s online systems and account data, according to a press release.
Out of the $1.4 million that was taken through a total of 44 unauthorized withdrawals, Nappier said that TFI “recovered or stopped” $442,540. CHET Advisor accounts managed by The Hartford have not been affected, Nappier noted.
In response to the breach, TFI upgraded its system, internal controls and manual reviews. It’s offering two years of identity fraud protection to affected account holders, $1 million in identity theft insurance coverage and is set to restore the hacked accounts “as if the unauthorized withdrawals never occurred,” said Nappier.
Nappier further stated her office is closely monitoring TFI’s security efforts and plans to launch an independent audit of fraudulent account activity and an independent review of TFI’s cyber, telephone and manual security programs.
TFI spokesman Chad Peterson told the Insurance Journal they see evidence the hackers received CHET account holders’ personal information from outside CHET and TFI, then used it to fraudulently access the 529 accounts and redirect payments.
“This is this first time that we are aware of fraudulent account activity in CHET’s 20 plus year history,” Nappier said. “And I am deeply concerned that these criminal activities have impacted CHET account holders.”