News

Campus Security: 13 Data Breaches Reported So Far This Month

• By David Nagel
• January 29, 2008

According to a report yesterday in Baylor's campus newspaper, The Lariat, a student employee accessed the IDs of 526 users of the university's communications service, the Baylor Information Network. It was the second suspected "inside job" reported this month at a university.

Insider Incidents
In the Baylor incident, according to The Lariat, there was no theft of Social Security numbers or financial information. However, the information obtained did provide access to the affected users' e-mail and Blackboard accounts. Upon discovering the breach, Baylor's IT department shut down the Baylor Information Network, which remains offline, and notified affected individuals. The FBI is currently investigating the matter, according to the paper.

Earlier this month, another insider job was reported at Central Piedmont Community College in North Carolina. There, according to campus security watchdog ESI (Educational Security Incidents) and North Carolina NBC affiliate WCNC, a student worker was arrested New Year's Day and charged with embezzlement. She's also under investigation for possible charges relating to identity theft when a supervisor noted that she'd copied down Social Security numbers and birth dates from employee records.

"Insider attacks are initiated by rogue employees, consultants, and/or contractors of an organization," the SANS Institute said in its "Top Ten Cyber Security Menaces for 2008" report, issued Jan. 14. "Insider-related risk has long been exacerbated by the fact that insiders usually have been granted some degree of physical and logical access to systems, databases, and networks that they attack, giving them a significant head start in attacks that they launch. More recently, however, security perimeters have broken down, something that allows insiders to attack both from the inside and from outside an organization's network boundaries. Insider-related risk (as well as outsider risk) has thus skyrocketed. Organizations need to put into place substantial defenses against this kind of risk, one of the most basic of which is limiting access according to what users need to do their jobs."

Data Exposure, Losses, Breaches
Beyond insider attacks, January has so far seen several incidents of lost hard drives, exposure of user information on the Web, and outright hacks penetrating network defenses.

SSNBreach.org has reported this month five incidents in which colleges and universities posted user information online. These include:

• Texas State University's Computer Science Department, which has posted employment information and other data about Southwest Texas State University faculty and administrators from 1998 through 2003 in an Excel file that has been online since March 2006.
• Information about Murray State University College of Education students, including Social Security numbers, was posted online in an Excel file and accessible through Google's cache for about a year and a half. Two hundred sixty students were affected.
• At Colorado State University, four files were discovered online that contained information about 300 students on the Warner College of Natural Resources Web site, including passwords and 208 Social Security numbers. The university has since removed the files and worked to get the information out of search engine caches.
• An Excel file containing personal information from 89 Brigham Young University medical school applicants was placed online. The file has since been removed.
• An Excel file was also discovered on Montana State University's Web site containing names, Social Security numbers and other personal data on 42 employees who were hired in 2006. The file has since been removed.

Similarly, according the The Iowa City Press-Citizen, the University of Iowa's College of Engineering notified 216 former students earlier this month that their personal information, including Social Security numbers, had been posted online for several months.

In the category of lost data, Tennessee Tech reportedly lost a flash drive containing names and Social Security numbers of 990 students who resided on the campus in fall 2007. The university notified the students and apologized but said there was no evidence that the data has been used for identity theft. The university also said in a statement released Jan. 14 that it will be moving to a new data system that will replace Social Security numbers with individually assigned campus ID numbers.

Earlier in the month, the University of Akron also alerted current and former students from the College of Education that a hard drive containing Social Security numbers and other personal information was lost. For the 800 individuals affected, the university offered a free year of fraud protection service, in addition to providing resources to assist with and answer questions about the incident.

A hard drive was also reported stolen from New Mexico State University. ESI said the hard drive was a backup used by a university employee and that it contained the names and Social Security numbers of all Special Events Department employees hired since 1999. ESI said the data on the drive was encrypted and that the department is "working to determine just how many individuals were affected by this incident and is working to notify those individuals."

Finally, there have also been two university server hackings reported so far this month. The University of Georgia's security breach is suspected of exposing as many as 4,250 Social Security numbers, including those of several hundred current residents.

The other hacking incident involved California State University, Stanislaus, where a dining hall computer was apparently breached, exposing credit card numbers and customer names, according to the Central Valley Business Times. The incident occurred in November 2007 but was not reported until January.