An investigation by the Denver Gazette shows the Colorado Department of Higher Education waited more than a month to report a data breach.