Cyber Incident Victim: Barry University
Date:
May 2013
Location:
United States of America
Summary
Barry University experienced a malware infection on a computer system containing personal and medical information of patients from its Foot and Ankle Institute, potentially exposing sensitive data. Although forensic investigators could not confirm whether unauthorized access or data exfiltration occurred, the institution implemented enhanced security protocols and engaged IT specialists to fortify systems following the incident, with no reported cases of identity fraud linked to the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In May 2014, Barry University in Miami Shores, Florida, identified malware on a computer system containing personal and medical information of patients treated at its Foot and Ankle Institute. The university promptly engaged a third-party computer forensic firm to investigate the incident and remove the malicious software from the affected device. Forensic analysis could not conclusively determine whether the malware had successfully extracted patient data or whether unauthorized individuals had accessed the information. The compromised data included sensitive patient details, though the university did not publicly specify the exact types of information stored on the infected system. No evidence emerged suggesting the stolen data had been misused for identity fraud or other malicious purposes following the breach discovery. Barry University officials maintained transparency by notifying affected patients about the potential exposure despite the inconclusive forensic findings.
Following the investigation, Barry University implemented enhanced data security protocols across its IT infrastructure to prevent similar incidents. The institution contracted an external IT security specialist to strengthen system defenses and mitigate future vulnerabilities. While the malware’s origin and intrusion method remained unspecified in public disclosures, the university focused remediation efforts on securing patient data storage systems. No fines, legal actions, or operational disruptions were reported in connection with the incident. The breach exclusively impacted patients of the Foot and Ankle Institute, with no indication of compromise to other university departments or academic records. Barry University’s response emphasized proactive risk management through technological upgrades and expert consultation without confirming any actual data theft or misuse.