eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Former and current faculty and students at the University of Wisconsin-Milwaukee may have had their Social Security numbers exposed by malware.
Malware planted on a document-management database server may have exposed 75,000 student and staff Social Security numbers and names, the University of Wisconsin-Milwaukee said Aug. 10. Considering the amount of critical research data stored on the server, the malware was most likely after research data and not personal information, said Tom Luljak, the university vice chancellor.
It’s unknown how long the back-door malware was lurking undetected on the server, used by many departments to store research data and details about current and past cutting-edge research projects, but officials guessed it was for a “short period of time.”
“Investigators theorize that the motive was not identity theft, and could find no proof of attempts to download names or social security numbers,” said John McCarragher, the interim chief information officer at the University of Wisconsin-Milwaukee.
It’s also unclear whether the malware had access to other servers on the university network. Administrators immediately shut down the server after finding the malware and “reassessed security before restarting it,” said McCarragher.
That is one of the biggest mistakes organizations make after discovering a breach, Geoff Webb, senior product marketing manager at Credant Technologies, told eWEEK. While senior management may be saying “shut everything down,” the security team should resist the pressure and take the time to investigate what happened without alerting the attackers, Webb said. If the attackers figure out they’ve been detected, they would try to cover their tracks and potentially destroy any evidence on the breached system, according to Webb.
The University’s technology staff discovered the malware May 25. The malware, which had the ability to view all documents stored on the server, was most likely installed remotely, according to Luljack. Then local and federal law enforcement authorities investigating the security breach incidentally discovered June 30 the server also housed a database with Social Security information for students and employees.
“We don’t believe anyone got access to the image bank. There is no evidence that the hackers actually looked at or retrieved any information,” Luljak said.
Even though law enforcement and school investigators have not yet found evidence that the Social Security numbers were actually stolen from the database, the university sent out a letter to all those who may be affected. Since the data may not have been stolen, the University of Wisconsin said it would not pay for credit-monitoring. Instead, it warned students and staff to be vigilant about monitoring their credit history and putting a freeze on their credit reports.
The warning may fall on deaf ears. A recent report from Javelin Research found that 18- to 24-year olds generally take twice as long to find out their identity has been stolen, primarily because they are less likely than other age groups to regularly track activity in their bank accounts and credit cards. This age group was also less likely to use identity-theft monitoring services, Javelin found.
Even if the data was not downloaded, the incident is a reminder to organizations to protect data on their servers and networked devices faculty and administrators use. Students and staff frequently go off campus, and “data security doesn’t end when they leave campus,” Webb said. All mobile devices need to be encrypted as well.
University of Wisconsin disclosed its breach a day after California State Polytechnic University, Pomona notified 38 current and former faculty members in the College of Business Administration that their personal information had been accidentally exposed.
A staff member on Aug. 2 mistakenly placed two documents containing full names and Social Security numbers on a shared network, not realizing students and other faculty and staff could view the files. It doesn’t appear the data was copied or misused, but the university is conducting an internal review of its procedures to handle confidential data.