A hacker exposed the Social Security numbers and names of 60,000 University of Wisconsin students earlier this fall, University of Wisconsin officials announced Thursday night.
UW discovered the hack Oct. 26, which UW spokesperson John Lucas said resulted from what he referred to as a breach in the “Legacy Database.”
The “Legacy Database” refers to Wiscards printed prior to 2008 that had student’s social security numbers embedded on the cards, Lucas said. He added only the names and social security numbers of students were exposed, not addresses or other personal information.
While not all students on campus prior to 2008 may be in the database, Lucas said anyone whose data was compromised will be notified via letter by UW.
Lucas emphasized the fact that students on campus since 2008 have nothing to worry about, and even students here before 2008 may not be at risk.
“It’s important for current students within the last two years (to know they) are not affected by this… the Wiscards with the social security numbers were deactivated in 2008,” Lucas said. “It doesn’t necessarily mean anyone with a Wiscard before 2008 [had their information exposed].”
Division of Information Technology spokesperson Brian Rust said DoIT investigated the Wiscard computer system, known as Wisconsin Unions, upon making the discovery.
DoIT staff collaborated with Wisconsin Unions staff to determine the scope of the breach and figure out who the hacker was and where the hacker was from, Rust said. The information has since been taken offline, Lucas said.
Unlike the chemistry computer hack of Oct. 2009, during which hackers left illegally downloaded music and movies on the machines, Rust said no evidence was found to determine why the hacker would breach the system.
UW tries to prevent these types of exposure, Lucas said, but on such a large campus the task is difficult. UW still takes security seriously, however, Lucas said.
“Certainly it’s a fairly substantial exposure when you talk about 60,000 people… it does not ensure that hackers are in receipt of the social security numbers,” Lucas said. “To the best of their knowledge… they had not been downloaded.”
UW notified authorities upon finding the breach, but beyond UW Police, Lucas said he could not say whether the FBI was contacted. Representatives at the FBI bureau in Milwaukee could not be reached for comment by press time.
