Duke University School of Law Information Breached

12/11/07
Those whose numbers may have been seen were prospective applicants to Duke Law who were seeking information about the school. However, when a Duke website editor discovered "unauthorized broken links" on the site, school officials immediately took the links down and shut down the site.


"We have no evidence that the intruders actually downloaded or acquired any of this information," wrote the law school's associate dean of admissions, William J. Hoye, in an email. "Nonetheless, we know they had the opportunity and the tools to do so."

An investigation shows that the hackers may have attacked the site in early November and on Thanksgiving Day, said Duke spokeswoman Melinda Vaughn. She also said that the hackers broke into the site "through a vulnerability in third-party blog software used on the site."

Now, along with contacting the 1,400 of the incident, the school is warning them to watch their credit so they can protect themselves against identity theft.

But there's more. The hackers were not only able to view the database of prospective students and their Social Security numbers, but they were also able to view another database of current students, which included information such as home addresses, phone numbers, email addresses, and passwords. The number of students affected by this breach totaled 1,800. The school, worried that the passwords may allow hackers access to students' bank accounts, is advising the 1,800 to change their passwords.

"The security and safety of our community is of utmost importance to us, and Duke University works hard to protect the personal information of prospective students and other community members," said Hoye. "We are taking all possible steps to address this breach and prevent it from happening again. We also have notified law enforcement agencies and will notify any relevant government agencies about Duke's response."

At least, according to Jeremiah Grossman, WhiteHat Security chief technology officer, "in the case of a hack performed to improve search engine results for a particular website, intruders likely are not out to steal personal information."

Duke University School of Law, located in Durham, North Carolina, began as the Trinity College School of Law in 1868. Today, it is ranked as the 10th-best law school in the United States by U.S. News & World Report.