The exact nature of the information accessed varied depending on the person's connection to the university, but the list of data obtained included things like dates of birth, Social Security numbers and passport information, according to a news release from the U. The university said its investigation "showed no evidence that donation, medical treatment, password, or credit card information was in the database" that was accessed.
The disclosure comes two months after the Cyber Express, a news site focusing on cybersecurity issues, published a report outlining a hacker's claims that they accessed some 7 million Social Security numbers dating to 1989. The report said the hacker accessed the university's data warehouse to analyze the effects of affirmative action in the wake of a recent U.S. Supreme Court ruling that limits the consideration of race in college admissions.
The university is facing six lawsuits from former students, employees and others who claim the U didn't do enough to protect their sensitive data or to promptly notify them of the breach. Some of the university's initial responses to those lawsuits are due in the coming days.
University officials have said they hired an outside firm to help investigate the hacker's claims after learning of them on July 21. On Thursday, the U released some details of that probe.
The university said it believes the incident "potentially affected" people who applied to the university, enrolled at the university, worked for the university or participated in university programs between 1989 and August 2021. As a result of the investigation, the U believes the data was accessed in 2021, according to spokesperson Jake Ricker.
The breach is also being investigated by the Minnesota Bureau of Criminal Apprehension, and the FBI's Minneapolis office has said it is "aware of the situation" as well.
"The safety and privacy of all members of the University community are a top priority, and the University has increased its vigilance in securing information that it maintains," university officials said in a news release, adding that they had reduced the number of people authorized to access sensitive information, increased monitoring for suspicious activity and taken other steps aimed at boosting security.
The U said it will offer 12 months of free credit and identity monitoring services to people affected by the breach. It is sending notices via email, from the address data-incident@notification.umn.edu.
"The University's notification approach is aimed at notifying potentially affected individuals whose private data may have been accessed so, out of an abundance of caution, we are notifying all individuals identified with any data element in the data warehouse," Ricker said. "The University will send email notifications to approximately two million individuals as part of its notification efforts."
People who don't have a current email address on file with the U can find additional information at system.umn.edu/data-incident.
The following are the types of information that the university said were potentially accessed, depending on the person's affiliation with the U:
- Prospective students (and parents or guardians): Information supplied in admissions or financial aid applications submitted directly to the University or through the standard Free Application for Federal Student Aid (FAFSA) form, including student and parent or guardian names, contact information, Social Security numbers, dates of birth, student high school and high school grade information, standardized test scores, demographic information and family income.
- Students: Information related to the individual's education, including student contact information and parent or guardian names and addresses, student email addresses, Social Security number, student ID number, date of birth, classes, grades, demographic information, insurance policy number, loan data, degree and diploma year.
- Employees: Information related to the individual's work, including name and address, email address, Social Security number, employee ID number, date of birth, driver's license or identification card, and payroll information (but not bank account information).
- Others: Similar categories of information as described above, if provided by individuals with unpaid university appointments, those who performed work for the university, those who received taxable payments from the university, and university volunteers or spouses/partners of certain university administrators.
This story is developing and may be updated.
©2023 StarTribune. Distributed by Tribune Content Agency, LLC.
