UMaine breach exposes 4,585 students' clinical data
The University of Maine police department is leading the investigation into the breach of two UMaine computer servers this spring. Sensitive data related to approximately 4,585 students were exposed as a result of attacks by hackers, according to a statement by the University.
The servers comprised files dating back to 2002, which contained information associated with the UMaine Counseling Center, including names, social security numbers and clinical information relative to every student who engaged counseling center services between Aug. 8, 2002 and June 21, 2010, according to the statement.
A server that contained student data covering 2002 to 2005 was hacked as early as March 4 while a second server, which contained all the data in the first server plus information from 2005 to present, was subsequently compromised.
UMaine, located in Orono, said its investigation began on June 16, when counseling center staff members reported difficulty accessing server files. According to the university, there is currently no indication that data were viewed, compromised or downloaded from either of these servers, but the university is operating according to a worst-case scenario.
To preserve the integrity of the investigation, police will not disclose the specific techniques the hackers used to access the servers, UMaine stated. The UMaine police department is consulting with the U.S. Attorney’s office and computer crimes experts from the U.S. Secret Service.
UMaine has also engaged identity-theft fighting company Debix to monitor, for at least 12 months, for indications of identity theft and any fraudulent activity related to affected students' credit. The Austin-based company will also provide immediate alerts to individuals if there is suspicious activity related to their credit, along with identity theft insurance.
In addition, the university is sending a letter to each person in the database. Those letters, which will be mailed in early July, will include details about how to access Debix’ services, which will be provided at no cost to those affected. Any student or former student who visited the counseling center as a UMaine student since Aug. 8, 2002 should assume that he or she is in the affected database, according to the statement.
More information for those who may have been affected is online at http://www.umaine.edu/informationcenter.
The servers comprised files dating back to 2002, which contained information associated with the UMaine Counseling Center, including names, social security numbers and clinical information relative to every student who engaged counseling center services between Aug. 8, 2002 and June 21, 2010, according to the statement.
A server that contained student data covering 2002 to 2005 was hacked as early as March 4 while a second server, which contained all the data in the first server plus information from 2005 to present, was subsequently compromised.
UMaine, located in Orono, said its investigation began on June 16, when counseling center staff members reported difficulty accessing server files. According to the university, there is currently no indication that data were viewed, compromised or downloaded from either of these servers, but the university is operating according to a worst-case scenario.
To preserve the integrity of the investigation, police will not disclose the specific techniques the hackers used to access the servers, UMaine stated. The UMaine police department is consulting with the U.S. Attorney’s office and computer crimes experts from the U.S. Secret Service.
UMaine has also engaged identity-theft fighting company Debix to monitor, for at least 12 months, for indications of identity theft and any fraudulent activity related to affected students' credit. The Austin-based company will also provide immediate alerts to individuals if there is suspicious activity related to their credit, along with identity theft insurance.
In addition, the university is sending a letter to each person in the database. Those letters, which will be mailed in early July, will include details about how to access Debix’ services, which will be provided at no cost to those affected. Any student or former student who visited the counseling center as a UMaine student since Aug. 8, 2002 should assume that he or she is in the affected database, according to the statement.
More information for those who may have been affected is online at http://www.umaine.edu/informationcenter.