Campus Security: 13 Data Breaches Reported So Far This Month
A breach at Baylor University is the latest in a string of more than a dozen
data security incidents on U.S. campuses reported by a variety of sources
so far in January 2008.
According to a report yesterday in Baylor's campus newspaper, The Lariat, a student employee accessed the IDs of 526 users of the university's communications service, the Baylor Information Network. It was the second suspected "inside job" reported this month at a university.
In the Baylor incident, according to The Lariat, there was no theft of
Social Security numbers or financial information. However, the information obtained
did provide access to the affected users' e-mail and Blackboard accounts. Upon
discovering the breach, Baylor's IT department shut down the Baylor Information
Network, which remains offline, and notified affected individuals. The FBI is
currently investigating the matter, according to the paper.
Earlier this month, another insider job was reported at Central Piedmont Community
College in North Carolina. There, according to campus security watchdog ESI
(Educational Security Incidents) and North Carolina NBC affiliate WCNC, a student
worker was arrested on New Year's Day and charged with embezzlement. She's also
under investigation for possible charges relating to identity theft when a supervisor
noted that she'd copied down Social Security numbers and birth dates from employee
"Insider attacks are initiated by rogue employees, consultants, and/or
contractors of an organization," the SANS Institute said in its "Top
Ten Cyber Security Menaces for 2008" report, issued on Jan. 14. "Insider-related
risk has long been exacerbated by the fact that insiders usually have been granted
some degree of physical and logical access to systems, databases, and networks
that they attack, giving them a significant head start in attacks that they
launch. More recently, however, security perimeters have broken down, something
that allows insiders to attack both from the inside and from outside an organization's
network boundaries. Insider-related risk (as well as outsider risk) has thus
skyrocketed. Organizations need to put into place substantial defenses against
this kind of risk, one of the most basic of which is limiting access according
to what users need to do their jobs."
Data Exposure, Losses, Breaches
Beyond insider attacks, January has so far seen several incidents of lost hard
drives, exposure of user information on the Web, and outright hacks penetrating
SSNBreach.org has reported this month five incidents in which colleges and universities posted user information online. These include:
- Texas State University's Computer Science Department, which has posted employment information and other data about Southwest Texas State University faculty and administrators from 1998 through 2003 in an Excel file that has been online since March 2006.
- Information about Murray State University College of Education students, including Social Security numbers, was posted online in an Excel file and accessible through Google's cache for about a year and a half. Two hundred sixty students were affected.
- At Colorado State University, four files were discovered online that contained
information about 300 students on the Warner College of Natural Resources
Web site, including passwords and 208 Social Security numbers. The university
has since removed the files and worked to get the information out of search
- An Excel file containing personal information from 89 Brigham Young University medical school applicants was placed online. The file has since been removed.
- An Excel file was also discovered on Montana State University's Web site
containing names, Social Security numbers and other personal data on 42 employees
who were hired in 2006. The file has since been removed.
Similarly, according the The Iowa City Press-Citizen, the University
of Iowa's College of Engineering notified 216 former students earlier this month
that their personal information, including Social Security numbers, had been
posted online for several months.
In the category of lost data, Tennessee Tech reportedly lost a flash drive containing names and Social Security numbers of 990 students who resided on the campus in the fall of 2007. The university notified the students and apologized but said there was no evidence that the data had been used for identity theft. The university also said in a statement released on Jan. 14 that it will be moving to a new data system that will replace Social Security numbers with individually assigned campus ID numbers.
Earlier in the month, the University of Akron also alerted current and former students from the College of Education that a hard drive containing Social Security numbers and other personal information was lost. For the 800 individuals affected, the university offered a free year of fraud protection service, in addition to providing resources to assist with, and answer, questions about the incident.
A hard drive was also reported stolen from New Mexico State University. ESI said the hard drive was a backup used by a university employee and that it contained the names and Social Security numbers of all Special Events Department employees hired since 1999. ESI said the data on the drive was encrypted and that the department is "working to determine just how many individuals were affected by this incident and is working to notify those individuals."
Finally, there have also been two university server hackings reported so far this month. The University of Georgia's security breach is suspected of exposing as many as 4,250 Social Security numbers, including those of several hundred current residents.
The other hacking incident involved California State University, Stanislaus,
where a dining hall computer was apparently breached, exposing credit card numbers
and customer names, according to the Central Valley Business Times. The
incident occurred in November of 2007 but was not reported until January.
Dave Nagel is the executive editor for 1105 Media's educational technology online publications and electronic newsletters. He can be reached at firstname.lastname@example.org.