Group says it hacked systems at 100 major universities

Harvard, Stanford, Penn among those hit; breached data mostly innocuous, analyst says.

A hacking group that calls itself Team GhostShell this week claimed credit for breaking into servers at 100 major universities from around the world, including Harvard, Stanford, the University of Pennsylvania and the University of Michigan.

In a message posted on Pastebin, the group said it accessed and publicly posted about 120,000 records from the breached servers.

The group, which recently claimed creditfor several major hacking incidents, said it attacked the university systems to focus attention on what it called a failing educational standards around the world.

A Computerworld review of a small portion of the publicly posted data showed what appeared to be names, phone numbers, email addresses, login credentials and other data from some of the breached servers.

In some cases, the hackers appear to have breached multiple servers at the same university.

At least some of the publicly posted data appeared to be innocuous.

In its Pastebin message, Team GhostShell claimed that it deliberately leaked little information from the hacked servers.

"We tried to keep the leaked information to a minimum, so just around 120,000+ accounts and records are here, leaving in their servers hundreds of thousands more," the message said.

"When we got there, we found out that a lot of them have malware injected. No surprise there since some have credit card information stored," it added.

A spokeswoman from Stanford University today confirmed that two of its departmental websites had been improperly accessed.

However, information security officers at the university consider the breach to be minor, she said. "No restricted or prohibited data was compromised, nor was any sensitive or other personal information that could lead to identity theft."

"The breach was discovered (Tuesday) night and the sites and their servers have been secured," the spokeswoman added in an emailed comment.

A University of Michigan spokesman confirmed that Team GhostShell had gained access to three servers.

"However there was no sensitive data or passwords accessed," he said in emailed comments. "What they gained access to was data that is generally available to the public on our website."

Officials at Harvard and Penn did not respond to a request for comment on the reported intrusions.

In a blog post, Identity Finder, a New York-based provider of data leak prevention software, said that its analysis of the leaked data suggests that the hackers spent about four months aggregating the information.

The leaked data includes more than 36,000 unique email addresses, and thousands of usernames and passwords -- some of them stored in hashed form and some in plain text format.

The compromised data also included thousands of names, addresses, and phone numbers, "several" dates of birth, and also information on citizenship, ethnicity and marital status of staff, students and alumni.

The compromised information did not include credit card information, Social Security Numbers or bank information, the blog added.

Aaron Titus, privacy officer at Identity Finder, said that based on the company's evaluation, the breach is not very serious.

"The quality of the leaked information is not very sensitive. It is very diverse, but sometimes there's no sensitive information at all," Titus said. "But I hasten to add that for any one person, the exposure of their username and password can be devastating."

Titus said that all of the leaked information appears to have been culled from small departmental servers and subdomains.

All of the attacks on the university servers appear to have been SQL injection attacks. "The output of the attacks suggest a very straightforward SQL dump. That is very typical of SQL attacks," he said.

No central university server appears to have been breached, according to Identity Finder's evaluation. The intrusions once again highlight the unique challenges that many universities face in protecting data, Titus noted.

"Universities are very decentralized. Every department is its own fiefdom. Academic freedom means these entities make their own rules," even around information security, he said.

As a result, it's not unusual to find sensitive data often stored on numerous insecure departmental servers across a university, he said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, send e-mail to or subscribe to Jaikumar's RSS feed .

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts