After thousands of Louisiana customers have been shut out of their state-run college savings accounts for more than a week, state officials said Wednesday that limited access to the accounts has been restored and that the money appears to be secure.
The outage, which officials said was caused by a “cyber incident,” has prevented customers from accessing about 88,000 active savings accounts containing some $1.8 billion, according to state figures from last month. The accounts are part of Louisiana’s 529 education savings account programs, known as START and K12 START, which help families save for college or private school tuition. During the system shutdown, students and families have not been able to withdraw money from their accounts to pay tuition bills.
While scheduled withdrawals are still pending, customers now can at least check their balances as of Sept. 26, before the outage began, officials said Wednesday.
“We’re pleased to say that, as of right now, the 529 accounts are back up for viewing,” Louisiana Commissioner of Higher Education Kim Hunter Reed told state lawmakers during an unrelated hearing Wednesday. Reed also said there is “no indication of unauthorized access to the accounts or their funds” during the outage.
All Louisiana colleges and universities have been notified of the disruption, as have about 300 out-of-state colleges where savings account holders are enrolled, Reed said. They have been asked to work with affected students who can’t access funds needed to pay their bills.
For now, account holders still don’t have full access to their money. Deposits and withdrawals that were scheduled to occur after Sept. 26 have not yet been processed, and any new transactions must wait until the backlog is cleared, Reed added. Current balances won’t be available until after those transactions are processed, officials said.
Officials also still did not say whether the outage, which state police and other agencies continue to investigate, was caused by a cyberattack and if customers’ personal information was compromised.
“It’s an ongoing investigation so we can’t provide more information than we’ve given at this time,” said Elizabeth Bentley-Smith, deputy commissioner for finance and administration at the state Board of Regents, which oversees higher education.
The unexplained shutdown has alarmed parents and students who have been unable to check their account balances or withdraw funds for more than a week. They also have been unable to contact the Louisiana Office of Student Financial Assistance, or LOSFA, which manages the savings programs and has not been able to answer calls or emails during the technology disruption.
“It’s been a week since I’ve been able to log in so I have no idea if my money’s even there,” said Jamie Diamond, a parent in Abita Springs who put money in a START account to help pay for her son’s education at LSU.
Diamond said she could not reach LOSFA and has not received any notification from the agency about the status of her account.
“Zero communication,” she said, adding that her only sources of information have been the agency’s social media posts and news reports. “That gives me zero confidence.”
Rep. Kim Carver, R-Mandeville, said that agencies’ limited communication with customers during the outage created a “reputational risk” to the college savings program.
“It’s a great program, we don’t want people to lose confidence and look at other investments in the future,” he said during the legislative hearing, urging state agencies to provide “open, transparent, frequent communication” with account holders.
Under Louisiana law, any agencies or businesses that store people’s personal data must notify affected individuals of a security breach “without unreasonable delay,” and no later than 60 days after a breach is discovered. Entities that fail to alert the state attorney general’s office within 10 days of notifying affected individuals can face fines up to $5,000 for each day past the 60-day mark.
Attorney General Liz Murrill said that LOSFA and the Board of Regents, which houses LOSFA, have met the reporting requirements.
“They notified my office of the potential breach and the steps that are being taken to protect the system and people’s information,” she said in a statement. “I’ve urged them to take all steps necessary to ensure people’s personal information is secured.”
Board of Regents Chair Misti Cordell said the agencies hope to use the experience to strengthen their cyber security systems.
“We’re learning a lot through the process to make things more secure,” she added.
While LOSFA’s systems remain down, account holders can call the Board of Regents at 225-342-4253 or email START@laregents.edu.