Southern Connecticut State University Warns Of Data Breach After Web Defacement
Southern Connecticut State University is notifying 11,000 current and former students that their Social Security numbers may have been compromised two weeks after discovering that its website had been used by hackers to spam fancy wedding rings.
The personal data was in a file on the university’s web server, which was accessed by criminals who were using the university’s site as part of a spam operation. The hackers were using university server as a hosting for their own websites.
Pages on the university’s site contained ads for diamond rings, Viagra and Cialis. After noticing the ads on April 9, IT staff discovered the file containing the sensitive information. During security review after the hacker incident, this file there and it wasn’t properly secured, so it could have been targeted by someone. The file contained names, addresses and Social Security numbers of students who had registered to graduate from the school, dating back to 2002.
The university believes that the hackers came from outside the U.S., and it is working with the Connecticut attorney general’s office to investigate.
Students affected by the breach are being offered identity protection services for two years.
The university’s attack does not appear to be connected with recent widespread SQL injection attacks. In those hacks, attackers had been using the websites to attack other computers and infect them with malware. With Southern Connecticut, the motive appears to have been tied to spam.
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.