Real-World Examples of Data Breaches and Hacks in Colleges and Universities
The education sector is particularly vulnerable to cyberattacks. Valuable data, like intellectual property and personally identified information (PII), is sought after by cybercriminals in these often financially-motivated attacks.
The increased use of digital platforms, shared online resources between stakeholders (students, staff, professors, visiting lecturers, etc.), and working from home has enabled cybercriminals to target higher learning institutions, especially during the pandemic.
Roughly 50% of colleges and universities were affected by a social engineering incident in 2020 alone, and more than a quarter of the attacks led to confirmed data breaches.
Among those who made headlines for data breaches in recent years are a textbook rental company, a Catholic university in Australia, and a host of schools in the U.S. These incidents illustrate the threats academia faces and ways institutions can protect their data.
PS: Students can get one year of Dashlane Premium for free by signing up here.
The college that shut down permanently after a ransomware attack
Who was hacked: Lincoln College in Illinois, which opened in 1865 and qualified as a predominantly Black institution under the Department of Education
The attack: In May of 2022, Lincoln College was hit with a ransomware attack that they were unable to recover from. While the pandemic contributed to the shutdown, with students opting to defer enrollment or take a leave of absence, the school was the first to close partly because of a ransomware attack.
The cyberattack rendered critical systems inoperable, such as those used for fundraising, recruitment, retention, and enrollment, and blocked institutional data.
The takeaway: This particular ransomware attack made it impossible for the school to access their computer systems and data, which they could not afford to replace. If possible, higher learning institutions should join the Research Education Networking Information Sharing and Analysis Center (REN-ISAC) to stay up to date on cybersecurity threats and risk management.
Compromised passwords are often hackers’ way in to carry out a ransomware attack. Strengthening passwords across your organization can stop these attacks before they start.
The data breach of a textbook rental giant
Who was hacked: Chegg
The attack: In 2018, the online textbook rental service experienced a data breach that affected 40 million customers. Cybercriminals were able to steal usernames and email addresses, then decrypt and post the logins online.
The takeaway: Chegg did not alert individual users to the data breach; instead, colleges like Saint Mary’s College in Indiana were alerted by REN-ISAC (Research and Education Networks Information Sharing and Analysis Center), when Saint Mary’s email addresses turned up in the credential dump. By the time the college alerted students and staff about the breach, their credentials had already been exposed.
With a tool like Dark Web Monitoring, offered with all Dashlane Premium accounts, users will be notified immediately if their logins are compromised, and able to swiftly change their passwords. Additionally, Dashlane was built on zero-knowledge architecture, meaning that not even Dashlane has access to customer passwords, which helps defend against decryption strategies.
The phishing attack on a university in Australia
Who was hacked: Australian Catholic University (ACU)
The attack: In 2019, threat actors posed as the university and sent an email containing a link to a fake ACU page. When staff entered their credentials into the malicious page, the cybercriminals were able to harvest their logins and use them to gain access to sensitive information, including their bank accounts.
The takeaway: Though only a fraction of staff were affected in the ACU breach, phishing attacks can be sophisticated and highly destructive. Dashlane vigilantly monitors the web for imposters (and we will never ask for your credentials over email) to protect users. Having a password manager automatically protects you against phishing attacks—because Dashlane only autofills passwords in sites you trust, it won’t do so for any fake web pages trying to harvest your credentials.
If a hacker does get as far as stealing your passwords, make sure your sensitive accounts are protected with multifactor authentication, like 2FA codes.
If your staff could use a refresher on avoiding phishing scams, take a look at our top tips.
The ransomware attack that cost $1.14 million
Who was hacked: Columbia University; Michigan State; and the University of California, San Francisco (UCSF)
The attack: NetWalker, a group of ransomware operators, went on a ransomware spree in 2020, targeting universities. Through “brute force attacks”—trial and error password attempts by bots—NetWalker gained access to sensitive data, and threatened to expose the data if the universities failed to pay the ransom. One of the most affected by this double extortion scheme was UCSF, who paid $1.14 million in ransom to recover crucial data tied to the medical school’s academic work.
The takeaway: There are ways to protect against a brute force attack, including using passwords with the maximum amount of characters for sensitive accounts. When you generate a password with Dashlane, you can choose the number of characters—and you won’t have to remember the long string of numbers and letters (Dashlane does that for you). The longer the password, the longer it would take for software to “guess” it and the less likely cybercriminals are to succeed.
Enabling multifactor authentication for your accounts, in addition to creating long, secure passwords, is crucial.
Take a cue from this university that upped their password and security game with Dashlane, and learn more in our mini-guide for colleges and universities.
Sign up to receive news and updates about Dashlane
