October 12, 2012
The Miami Herald reports that hackers breaking into nearly 300,000 confidential computer records at Northwest Florida State College have compromised the identities of current and former students and employees. School officials conducted an internal investigation the first week of October and released their results on Wednesday. At least 50 cases of identity theft have been confirmed.
"We speculate this was a professional, coordinated attack by one or more hackers," College President Ty Handy said in an Oct. 8 email sent to college employees.
Names, birth dates, social security numbers, bank-routing numbers and other information were accessed from multiple files on the school's main server, according to the email. Over 200,000 records were hacked, some of which contained information on students who were eligible for the state’s Bright Future Scholarship between 2005 and 2007. These students were from all over the state and not just Niceville, where the school is located, noted CNET.
76,000 hacked records belonged to former and current students, the college announced, and some 3,000 other hacked records housed information on former, current and retired employees. Some 40 school vendors may have also had their information breached, according to the school email.
The school's IT department is working with external consultants to increase its online security, and the local sheriff's office has become involved. Handy said he does not expect any more breaches to occur, but that the numbers of victims affected by identity theft could increase.
"We've contained it, but what's been accessed, has been accessed," he told The Miami Herald.
School employees suffered the largest number of identify thefts. According to ars technica, thieves used their names and those of other victims to sign up for Home Depot credit cards and to obtain payday loans from Discount Advance Loans and PayDayMax, Inc. Handy was among the employees victimized, the school told The Miami Herald.
By law, officials are required to contact those affected by a breach within 45 days, according to the school email. "We will, well before the 45 day mandatory notification window is exhausted, provide a personal contact letting you know if your information has potentially been accessed," Handy said in the email.
Students wanting more information on the incident can look to the school website. A link there allows students to file a complaint with the local sheriff's office.
According to CNET, federal authorities have also joined in the investigation, but indicated the break-in does not seem related to a recent worldwide series of hacker attacks on higher-education schools.
Compiled by Maggie O'Neill
"Memo, Northwest Florida State College," nwfsc.edu, October 8, 2012, Ty Handy
"Officials: Security breach contained at Northwest Florida State College," miamiherald.com, October 11, 2012, Toluse Olorunnipa
"Personal info for 300K exposed in FLA college hack; already 50 identity theft cases," arstechnica.com, October 11, 2012, Sean Gallagher
"Thousands of student records stolen in Florida college breach," news.cnet.com, October 10, 2012, Steven Musil