Server hack at Georgetown Univ. probed

06.03.2006
Georgetown University in Washington has called in the U.S. Secret Service to investigate a server breach that may have exposed confidential information including the names, dates of birth and Social Security numbers belonging to more than 41,000 people.

The breach appears to have been caused by an external hacker and involved a server that was being managed by a Georgetown University researcher as part of a grant to manage information on the various services provided through the District of Columbia's Office of Aging, according to a university statement released Friday.

The breach was first discovered during routine internal monitoring of university networks by Georgetown's information security office on Feb. 12, according to Erik Smulson, a university spokesman. The server that was compromised was immediately disconnected from the network.

But because "it took some time to recognize the scope and nature of the exposure, the computer intrusion was not disclosed to the Office on Aging until Feb. 24, he said. Law enforcement officials were notified on Feb. 27, and the Secret Service took custody of the compromised server for forensic testing the next day.

Only data that was on the Office of Aging server was compromised, Smulson said. He added that the breach did not affect any of the university's core computer systems containing financial and admission records. There is no evidence that the compromised information has been misused so far, he said.

Georgetown University is now notifying the people whose information may have been exposed in the incident, Smulson said. But that task is complicated by the fact that the breached server contained records dating to 1983 on people who may be now deceased, he said.