About 160,000 people may have had their personal data stolen during a computer security breach at the University of California at Berkeley.
Affected groups include current and former UC Berkeley students and family members, as well as about 3,400 students of Mills College who received, or were eligible to receive healthcare at UC Berkeley.
The university has informed campus police and the FBI about the breach, and ithas begun notifying about 160,000 people whose data may have been stolen by hackers.
It has also removed the exposed databases from service to prevent further attacks.
The hackers had been operating for six months before they were discovered.
What Happened
The hackers breached the UC Berkeley server on Oct. 9, and their attacks continued until April 9, when computer administrators performing routine maintenance discovered messages the hackers left behind, according to a statement by the university.
They accessed a public Web site and bypassed other secured databases stored on the attacked server.
It is not yet clear whether the hackers hit one database or several.
The hackers are apparently based overseas. “Preliminary information from the IP (Internet protocol) addresses links the hackers to Asia,” Janet Gilmore, director of strategic communications at UC Berkeley, told TechNewsWorld.
More Details
The database or databases hacked contained Social Security numbers, health insurance information, immunization records and the names of the physicians the victims visited.
Victims include current and former UC Berkeley students who received healthcare services from the university, as well as family members who were linked to the students’ coverage.
The data for UC Berkeley students, alumni and family members dates back to 1999, and the information for former and current Mills College students dates back to 2001, according to UC Berkeley.
Why Mills?
Mills College, founded in 1852, has been in Oakland, Calif., since 1871. It’s a private women’s liberal arts college — the first women’s college west of the Rocky Mountains.
Its students were victimized by the breach because they are eligible for health services at UC Berkeley under an arrangement between the two institutions, UC Berkeley’s Gilmore said.
No Speed Records Broken Here
The fact that security was originally breached last autumn but not noticed until recently may leave some victims wondering why it took system administrators several months to discover the hack.
“Campus IT officials and security experts are investigating this breach to determine all we can about how this happened and what can be done to minimize the chances of this happening again,” Gilmore said, declining to provide further detail.
However, the pattern of discovery is similar to a breach at the University of Florida perpetrated by hackers from abroad. The breach was discovered earlier this year during a routine system check after the attacks had been going on for some time. In the University of Florida’s case, that period was about a month.
Getting Protection
Intrusion-detection tools and monitoring tools that sound an alarm as soon as an intruder tries to breach a system are readily available.
“It’s really hard to get funding for security until after something bad happens,” Randy Abrams, director of technical education at antivirus vendor ESET, told TechNewsWorld. “When people see the cost of failure, then they’re willing to pay.”
A two-factor authentication approach, where both hardware and software are used to protect data, is a good safeguard, Abrams said. The hardware could be anything from authenticated, secure USB dongles to smart cards.
“We anticipate that our pending investigation will provide us with helpful information on how to strengthen our current policies and practices,” UC Berkeley’s Gilmore said.
Loading ...
