IoT
Software // Information Management
News
5/24/2007
06:05 PM
50%
50%

University Blames Security Breach On Unpatched Symantec Bug

The University of Colorado at Boulder says the faulty antivirus software exposed sensitive information on nearly 45,000 students.

The University of Colorado at Boulder said sensitive information on 44,998 students was exposed because a worm attacked the network through an unpatched bug in Symantec's antivirus software.

A server in the university's College of Arts and Sciences' Academic Advising Center held the names and Social Security numbers of students enrolled at CU-Boulder from 2002 to the present, according to an online advisory.

On May 12, the university's IT security investigators discovered that the worm entered the server through the vulnerability, which the IT staff had failed to patch, the university reported. Investigators said they did not believe the hacker behind the worm was after the personal information, but instead was using the flaw as an entryway to other computers on the university network.

"The server's security settings were not properly configured and its sensitive data had not been fully protected," said Bobby Schnabel, CU-Boulder's vice provost for technology, in a written statement. "Through a combination of human and technical errors, these personal data were exposed, although we have no evidence that they were extracted."

A Symantec spokesman told InformationWeek that the company has been trying to get in touch with the university's IT team but has not yet talked to them to get details about the attack or even to find out what vulnerability was involved. "We hate to see any customer with a problem," he said. "We encourage customers to post patches as soon as possible."

Todd Gleeson, a dean CU-Boulder, said in a statement that he wants the College of Arts and Sciences IT operations to be placed under the direct control of the university's larger IT department. He said all of the students affected by the breach are being notified through letters mailed to their homes.

"We have also taken steps to ensure that all sensitive personal data has been removed from our Academic Advising Center servers," said Gleeson. "I want to assure our past and present students that we have taken strong measures to protect our advising center computers and our students' personal information."

Students who are looking for more information about protecting themselves following a data exposure can go to the advisory Web site.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Agile Archive
The Agile Archive
When it comes to managing data, donít look at backup and archiving systems as burdens and cost centers. A well-designed archive can enhance data protection and restores, ease search and e-discovery efforts, and save money by intelligently moving data from expensive primary storage systems.
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends to Watch in Financial Services
IT pros at banks, investment houses, insurance companies, and other financial services organizations are focused on a range of issues, from peer-to-peer lending to cybersecurity to performance, agility, and compliance. It all matters.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on InformationWeek.com for the week of July 24, 2016. We'll be talking with the InformationWeek.com editors and correspondents who brought you the top stories of the week to get the "story behind the story."
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.