Educational Security Incidents (ESI)

Quick Facts

• Date: 9/2/2008
• Institution: University of Illinois
• Type of Incident: Impersonation
• Number Affected: 1
• Source: ESI
• Abstract Source: News Gazette
• Update1 Source: Daily Illini

Abstract
University of Illinois officials are working to track down who sent a fraudulent email message purportedly from Chancellor Richard Herman. The e-mail message, sent from the chancellor AT uillinois.edu e-mail account, denounces fraternities and sororities calling recruiting activities "aggressive" and claiming that such organizations "perpetuate social inequality, especially with respect to the opposite gender, and promote a lack of diversity." According to officials within the Office of the Chancellor, which controls the chancellor AT uillinois.edu, the e-mail was sent from the account but that the e-mail was not sent by the chancellor. The Campus Information Technologies and Educational Services (CITES) staff is looking into how this e-mail was sent and is attempting to determine how many people received the fraudulent e-mail. According to Robin Kaler, the UI's associate chancellor for public affairs, the university plans to take disciplinary action against the individual responsible for sending the e-mail.

Update1
According to Mike Corn, director of security and privacy for CITES, the hoax email was not the result of a security breach. While the email appeared to be sent to "everyone@uillinois.edu", that was not the case. According to Corn, this part of the email was just text and the email was just another form of "phishing", designed to get grab everyone's attention.

Quick Facts

• Date: 8/15/2008
• Institution: University of Otago
• Type of Incident: Impersonation
• Number Affected: 4
• Source: Pogo Was Right
• Abstract Source: Otago Daily Times

Abstract
Computer criminals were able to gain access to four University of Otago email accounts and use this access to send out 1.55 million spam messages. The computer accounts, belonging to university employees, were compromised after the university was targeted with a wave of "spear phish" emails asking recipients to respond with username and password information. The four employees do not face any disciplinary action but instead the university's information security office is using this as an opportunity to reach out to the university community.

Quick Facts

• Date: 1/9/2008
• Institution: Harvard University
• Type of Incident: Impersonation
• Number Affected: Unknown
• Source: ESI
• Abstract Source: The Harvard Crimson

Abstract
Theodore R. Pak, a Harvard undergraduate student, has been caught creating false identification including state drivers licenses and Harvard identification cards. Some of the Harvard ID cards allow access to student buildings and "Crimson Cash" accounts according to university officials. According to officials, there is no evidence that the fake ID cards were used to fraudulently access cash or personal information. However, Harvard sent a letter to Crimson Cash account holders suggesting these individuals review their accounts for fraudulent activity. At this point it is unclear whether or not the cards were used to gain unauthorized access to buildings.

Quick Facts

• Date: 1/4/2008
• Institution: Central Piedmont Community College
• Type of Incident: Impersonation
• Number Affected: Unknown
• Source: ESI
• Abstract: WCNC

Abstract
A Central Piedmont Community College student worker previously charged with embezzlement is also suspected of using her access to employee files to commit identity theft. According to the 18-year-old's former supervisor, beyond using the supervisor's credit card at Wal-Mart, the supervisor saw the student worker copy down names, Social Security numbers and birth dates from employee files. After searching the student workers house, police discovered a credit card, business card, prepaid Visa, insurance card and student identification in other people's names. CPCC officials have changed some of its security measures and are asking employees to check their personal information.

Quick Facts

• Date: 12/11/2007
• Institution: University of Calcutta
• Type of Incident: Impersonation
• Number Affected: 1
• Source: ESI
• Abstract Source: The Telegraph

Abstract
An unknown individual in Nigeria was able to obtain access to a University of Calcutta professor's e-mail account and used this access to fool a friend of the professor out of money. The account, belonging to Ratan Khasnabish, a business management professor at the University of Calcutta, was used to send an e-mail to a businessman the professor was friends with asking for money to help pay a hotel bill. The businessman, assuming everything was fine, quickly wired the requested $2,500 to help out. However, soon after the businessman received another e-mail asking for more money, this time to help pay for airfare back to Calcutta. The businessman became suspicious. According to the businessman, "I sent a reply in Bengali, written in Roman script, asking the sender to write back to me in the same style. But there was no response. I then called Khasnabish on his cellphone and learnt that he was in Calcutta, not Nigeria." Complaints have been filed with the state home department.