University of Colorado servers hacked

The University of Colorado has become the latest educational institution to fall prey to hackers. The school is warning about 43,000 people that they may be at risk of having their identities stolen after two of its servers were attacked, it said Thursday. One server, at the school's health center, contained the names, Social Security numbers, student ID numbers, addresses and dates of birth of about 42,000 people, the university said. Also stored on the server were the results of about 2,000 laboratory tests, the university said. The break-in was discovered on July 14. Initial investigation has found no evidence that personal data was extracted or abused, according to the university.

Security breaches appear to be a growing problem in higher education institutions. More than two dozen attacks on university servers have compromised private data during the last six months, the University of Colorado said, citing The Chronicle of Higher Education. Earlier this week, the University of Southern California said a database containing about 270,000 records of past applicants was hacked in June.

Criminal Market Making At University of Colorado hacking

University of Colorado servers hacked

Mr. AT Alishtari, POA and Founder of EDI Secure LLLP, sees ID Cyber thieves are again market making by going after private ID SS Numbers and private data online in colleges. Their software is incredibly flexible and as banks put up firewalls, they go to other targets and as bank firewalls fall, they return with renewed vigor.

Mr. Alishtari calls this repugnant criminal activity ID protection "market making" since these ID thefts force two factor authentication with an offline device on the market as best solution. EDI Secure LLLP owns this patent let this day July 22, 2003. That patent covers single use credit card number ID and it allows for two factor authentication with offline devices in the U.S.

[commsoft]

Details!

How was the hack done? By insiders? Were the hacked systems not behind firewalls?

Or were the firewalls, OS security, and application security (if any, in each case) all penetrated remotely? How did the data walk out the door?

The best way for the rest of us to learn from such events is for the details of how it was done to be released.

This shouldn't be a problem for the university unless the breach was a result of a failure to maintain good security practices.