UCLA Security Breach
UCLA has revealed what might be the largest computer security breach ever at an American university. University officials say hackers broke into a database containing personal information on about 800,000 current and former students, faculty and staff members.
UCLA officials say the database accessed by the attackers contained personal records with the names, Social Security numbers, birth dates, home addresses and other contact information. The database in question did not contain any banking or credit card information, but given the amount of personal data it did contain, the attackers could potentially steal the victim’s identities.
So far the University says that there is no evidence that information has been used in any way, but UCLA officials will be sending out a letter later today to those effected by the breach encouraging them to keep an eye on their consumer credit files and consider enabling fraud protection.
According to the UCLA announcement:
an unauthorized person exploited a previously undetected software flaw and fraudulently accessed the database between October 2005 and November 2006. When UCLA discovered this activity on Nov. 21, 2006, computer security staff immediately blocked all access to Social Security numbers and began an emergency investigation.
As noted above, the exploit and attacks appear to have been going on for just over a year. UCLA security technicians discovered the exploit when they noticed a series of suspicious database queries.
In the UCLA press release Acting Chancellor Norman Abrams says, “We take our responsibility to safeguard personal information very seriously.” He went on to assure students, “my primary concern is to make sure this does not happen again and to provide to the people whose data is stored in the database important information on how to minimize the risk of potential identity theft and fraud.”
The Los Angeles Times reports that there are “no comprehensive statistics on computer break-ins at colleges.” However, the Times goes on to say, “in the first six months of this year alone, there were at least 29 security failures at colleges nationwide, jeopardizing the records of 845,000 people.”
Also see the coverage on the 27B Stroke 6 blog.
