EmailEmail
PrintPrint
FBI joins hunt for CMU hacker
Business school computer breach could affect up to 6,000 people
Friday, April 22, 2005

With the FBI now in the hunt for whoever breached business school computers at Carnegie Mellon University, officials yesterday said the array of compromised data also included grades and job offer information, including salaries.

In addition to current students, thousands of Tepper School of Business alumni from as far back as the early 1950s may have been affected if they opted to include information about themselves -- like a phone number, street address or personal e-mail address -- in any of the databases compromised by one or more hackers.

"The entire school has been affected. Some of the information is more sensitive than others," Tepper spokesman Mike Laffin said.

Even as new details emerged about the incident's scope, officials reiterated that there was no indication any of the compromised data, including Social Security and credit card numbers, had been misused.

The breach occurred April 10 but was only disclosed by the university late Wednesday after potential victims were contacted, and well after an investigation was under way. Exactly how the system was hacked and for what motive remained unclear.

Investigators believe the attack originated outside the university.

That it happened on a tech-savvy campus that houses the U.S. Defense Department's Computer Emergency Response Team Coordination Center, known as CERT, drove home to some how vulnerable data is on the Internet. And the unease was not limited to students and employees in the business school.

"It's a little unnerving, said Ruben Perez, 21, a junior electrical and computer engineering major from New York City. "It bothers me that somebody could actually hack into a system and get my personal information, especially Social Security numbers. That's not good."

If identify theft was the motive, reams of personal data would have a financial value for anyone able to obtain it. But on research campuses there is no shortage of people capable of hacking into a system for fun or to make a point, said Doug Goodall, a Pittsburgh computer security consultant and president of Getronics Red Siren Security Solutions.

"You've got people doing it for the thrill of the game," he said.

In another development yesterday, Carnegie Mellon officials confirmed that the FBI's computer crime squad was part of the investigation.

"We're looking into the matter. That's about as far as I can go," said Bill Crowley, special agent with the Pittsburgh FBI office.

Tepper officials say the primary concern remains the 5,000 to 6,000 students, alumni, staff and others whose sensitive personal information, like Social Security and credit card numbers, may have been compromised.

They include graduate students and graduate degree alumni from 1997 to 2004, applicants for master's degree in business administration from September 2002 through May 2004, doctoral applicants from 2003 to this year, and participants in a conference that was being arranged by the school's staff.

The school also has begun notifying 14,000 to 15,000 others affiliated with Tepper who may have less-sensitive data that was compromised, like job offer information, student grades and personal contact information.

The job offer data from as far back as 1985 was entered by students into a database kept by the school's career opportunities center.

The database itself was not breached, but another computer that apparently housed the same data was, Laffin said.

The school said it considered that material less sensitive because it was not the sort of information likely to be used by someone attempting identify theft.

Tepper has 1,600 students and 14,000 alumni, including many from overseas. Carnegie Mellon officials said the rest of the campus was not affected by the incident, and they continued to say they see no link between it and a spate of recent computer breaches nationally involving college campuses.

Goodall said systems can be made more secure but not immune, "just like it's impossible to fully protect your house from somebody who drives by and throws a rock."

First published on April 22, 2005 at 12:00 am
Post-Gazette reporter Bill Schackner can be reached at bschackner@post-gazette.com or 412-263-1977.
Featured Homes
Featured Rentals