CampusCE Corporation, a Bellevue, Washington company, notified state regulators about a data exposure involving the Washington State Board for Community and Technical Colleges. The notice described a misconfigured log-permission setting in a PeopleSoft application hosted on the CampusCE platform that permitted potential access to two data files. The official notice states that the issue was identified on July 25, 2024, after an SBCTC service ticket, and was corrected within 30 minutes. The Washington Attorney General notice was dated August 29, 2024, and individual notices were dated September 13, 2024.
The notice identified 57,000 affected individuals, most of whom were Washington residents. Exposed information included names, birthdates, addresses, email addresses, telephone numbers, ethnicity or race designations, student identification numbers, and gender. The notice stated that Social Security numbers and financial information were not involved. The supplied breach record lists August 20, 2023, as the breach and discovery date, but the official notice describes potential access from 2022 through July 25, 2024 and identifies July 25, 2024 as the discovery date.