A year-and-a-half-long intrusion into the systems at the University of Connecticut's School of Engineering by hackers originating in China may have exposed personal information such as Social Security numbers and credit card data, officials said in a Friday statement, according to UConn Today.
The engineering school's IT security professionals – who first discovered malware March 9 on several servers – characterized it as “part of the school's technical infrastructure.” It began taking steps to bolster system safety. The affected servers were immediately taken offline and eventually rebuilt.
An investigation by Dell SecureWorks showed that the intrusion began in September 2013 and the school patched the vulnerability that hackers had exploited to access the server. In addition, the engineering school reset the passwords for its Active Directory. The school also deployed a “more granular system firewall separation.”
While it couldn't find evidence that data was stolen, the school began notifying those potentially affected by the breach, contacting students, faculty, staff and others, including 1,800 who used the school's Lync instant communication tool. In an “abundance of caution,” UConn said it would notify about 200 research sponsors who are contracted with faculty of the engineering school. Additionally, the school has begun an evaluation of all of its IT systems
"UConn places the highest priority on maintaining the security and integrity of its information technology systems," Michael Mundrane, UConn CIO and provost, said in a statement. "That's why, in addition to assisting individuals and research partners in responding to this incident, we're taking steps to further secure our systems."
The Hartford Courant reported that the school had confirmed the hack originated in China.
