14 DAY TRIAL // In February, the North Dakota University System (NDUS) discovered that one of its servers had been breached. According to the organization, the impacted server stored the details of 290,000 individuals.
NDUS believes that the hackers gained unauthorized access to the server sometime in late October 2013. They compromised an existing account’s login credentials in order to access the machine. However, for the time being, it’s not known how the attackers obtained the login credentials.
The server stored the social security numbers and other details of 291,465 current and former students, including Fall 2014 applicants. It also contained the social security numbers and employee IDs of 784 faculty and staff members.
After conducting a forensic analysis of the breached server, NDUS hasn’t found any evidence to suggest that the cybercriminals stole any of the information. In fact, it’s believed that they might have targeted the server for other purposes, not to steal data from it.
“Based on the forensic investigation, it is likely the intruder's intent was only to use the server's processing power to launch attacks on other computers and systems. The intruder may not have even been aware that the sensitive information was stored on this server,” reads the FAQ published by the university.
However, since there are no guarantees that no information has been stolen, the educational institution has signed a contract with AllClear ID to provide free Identity Protection Coverage for one year to those whose information was contained on the breached server.
All those who receive notification letters from NDUS can sign up for the service. A call center will be available starting with March 14 to answer any questions that affected individuals might have.
The university warns students to watch out for any phishing scams that might leverage the incident. Since NDUS is notifying them via email (at least those whose email addresses the organization has), it’s possible that cybercriminals will also take the opportunity to harvest some information.
It’s important for impacted individuals to remember that they will not be asked to provide their social security numbers to verify their identities, not on the phone and not via email.
“Information security is of the utmost importance to us, and it is very unfortunate this has happened.We are working diligently to help make sure this doesn't happen again. It's disturbing that higher education is often targeted by criminal elements in today's global assaults on IT systems,” said NDUS Interim Chancellor Larry C. Skogen.
“We completely understand that this incident could be distressing. We certainly hope that no one experiences any negative impact from this intruder's actions, but we are providing resources for those who would like them, and we will keep people apprised of any new developments.”