800,000 people hit by UCLA hack

seaeagle · Posted: Thu Dec 14, 2006 11:06 pm Post subject: 800,000 people hit by UCLA hack

800,000 hit by UCLA hack (Dan Whitcomb in Los Angeles, DECEMBER 13, 2006)

Quote:

A hacker has infiltrated a massive University of California, Los Angeles database containing personal information on 800,000 people in one of the worst computer breaches ever at a US university.

The highly sophisticated attack exploited a software flaw to crack the computer system in a bid to obtain Social Security numbers, UCLA said in notices sent to all 800,000 potential victims, most of them current or former students and faculty members.

The University had no suspects despite an emergency investigation that began shortly after the hack was discovered on November 21, said Jim Davis, UCLA associate vice chancellor of information technology. The FBI has also begun a probe.

"We definitely do not know who it is yet," Mr Davis said. "All indications so far are that this is a malicious, targeted attack and well orchestrated. And the other thing that was unnerving to us was that it was orchestrated in such a way so that it covered its tracks."

Mr Davis said the hacker apparently began trying to worm into the system more than a year ago but drew suspicion only after technicians investigating performance issues on the computer system noticed odd "data traffic patterns".

The database contained names, social security numbers, dates of birth, home addresses and contact information that could be used by identity thieves. Access is normally restricted to UCLA staff whose jobs require them to have access (continued)

seaeagle

An interesting follow-up:

TIME.com: Lessons from the UCLA Hack Attack -- Page 1

Quote:

......."This is huge," says Beth Givens, director of the Privacy Rights Clearinghouse [privacyrights.org], a nonprofit consumer advocacy group based in San Diego. "It affects almost everyone who has come into contact with UCLA, and puts them at risk for identity theft." A university representative told TIME.com that the compromised data stretches back as far as 12 to 15 years, so the hack attack could affect a significant number of people beyond those presently at the university, including those who attended UCLA or worked there in the 1990s, and possibly even those who simply applied for admission or financial aid. Givens says the combination of information accessed is valuable on the black market and likely to be sold. Buyers could use the data to fraudulently apply for cell phones or credit cards. Because Social Security numbers are almost never changed, hackers could also retain and resell the information for years to come. (continued)