University Of Wisconsin-Madison Leaves 60,000 SSNs Unprotected For Two Years

Colleges getting schooled on dangers of keeping social security numbers on file

A recent database breach that potentially exposed the Social Security Numbers of 60,000 former students and staff at the University of Wisconsin is bringing attention to the way higher education institutions store and protect SSNs -- even after theyve been discontinued as a student identification number.
The breach came to light earlier in the month when affected victims were informed by a letter from the university that their data might have been breached after sitting in an unsecure database for more than two years. Like many universities around the nation, University of Wisconsin had discontinued the use of SSNs in student identification numbers in 2008 to better protect student identities. Unfortunately, the university retained information about affected individuals within the poorly protected database even after their IDs were deactivated.
University officials say they were made aware of an intrusion into the database in October and have not found the individuals responsible for the hack. Though sensitive data was stored within the database, it claims its forensic investigation didnt provide evidence that former student data was accessed.
During our investigation and examination, we reviewed the available logs dating back to January 2008 and discovered the system suffered unauthorized accesses a number of times. However, supplemental logs available for a shorter time period did not show any evidence of file transfers consistent with the size of the database file that contained your personal information. Further, our investigation found no evidence that the unauthorized individuals were aware of your personal data in the database or that it has been retrieved or misused, the University of Wisconsin wrote in
its letter
(PDF) to potential victims.
According to Thom VanHorn, vice president of global marketing for AppSec, universities face a challenging situation because they often store data about large numbers of former users within their data stores, which tend to be spread out and inconsistently protected. The thing with educational institutions is that youre not just talking about current students, youre talking about years and years of alumni, he says.
Often old data is retained within test databases that remain online and slip through the cracks of the security infrastructure.
Thats why its so important for organizations not only to protect their production databases, but also to protect databases that are connected to the network that were test databases, VanHorn says. Because the database infrastructure is only as strong as its weakest link, and once youre on the network you can probe around and find test databases that have actual data.
University officials say that since the incident, it has taken all student ID card numbers with SSN information offline.
The University of Wisconsin breach was one of two major data breaches to beset a large higher education institution within the past several weeks. Last week,
Ohio State University announced a breach
that exposed 760,000 students, alumni and staff.
According to AppSec, since 2008 colleges and universities have exposed more than 2.3 million records.
Have a comment on this story? Please click Discuss below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security	▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security	▸ Making use of a homemade Android army ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
University Of Wisconsin-Madison Leaves 60,000 SSNs Unprotected For Two Years