BREAKING: Admissions server infected with viruses
An Office of Admissions server containing personal information of current, prospective and former undergraduate students was infected with a number of viruses on Nov. 11.
A security report on Nov. 16 showed “suspicious activity” on the computer, which was then put under investigation by members of the Information Technology Services.
Malware infected the computer, used as a server for admissions, that helps process electronic admissions applications. This malware could have allowed a person outside the university to access the server from Nov. 11 until it was discovered on Nov. 16. It was not confirmed whether any files containing student information were accessed.
The electronic application data of about 9,000 individuals who applied to Eastern between March 2000 and November 2009 were located on the computer, said Adam Dodge, Eastern’s information technology security officer.
“It is important to note that not all individuals that applied during this period were affected, only a small percent,” he said.
The information in the server includes names, Social Security numbers, dates of birth, mailing addresses and other contact information, Dodge said.
“This does create a small chance of identity theft, which is why the university has contracted (with Experian) to provide these individuals with a free one-year membership of credit monitoring and ID theft protection,” he said.
A notification released today on Eastern’s university newsletter states that Eastern has signed a contract with Experian, a credit-monitoring company. Those who may be potentially impacted are eligible to receive a free one-year membership in Triple Alert from ConsumerInfo.com, where one can receive credit reports. Dodge was unable to comment on how much money this contract would cost the university.
Although the investigation began almost immediately, Dodge said many factors contributed to the nearly three weeks of delay in making the announcement. First, an in-depth investigation by Dodge’s office took about three days to complete. After that, the university worked to gather information of the individuals’ information on the server, collected and verified addresses, and contracted with Experian, Dodge said.
This was not a targeted attack against the university and there is no way of knowing who had control over the server yet, he said.
“Given that this incident involves computers in different countries, it becomes very difficult to trace down the individual that may have had access to the server,” Dodge said.
The university mailed the letters of notification to applicants potentially affected Thursday and today. The university wanted to wait until they were sent before making any announcement, Dodge said.
In the case of similar problems in the future, Dodge said Eastern has started a full security review of campus servers.
“My office has developed additional reports that will help identify potential problems in the future,” he said. “In addition, ITS is working with departments on campus that have servers to review the configuration of these servers.”
The University Police Department is aiding the university in the investigation.
Eastern has set up a Web page and FAQ with more information about this event. To visit it, follow this link: www.eiu.edu/notice.
