Cyber Incident Victim: University of Alabama

In June 2019, University of Alabama staff preparing an old server for disposal at the Brewer-Porch Children’s Center discovered evidence of unauthorized login activity originating from outside the United States. The logins occurred between October 24, 2009, and December 9, 2009, indicating the server had been compromised approximately ten years prior to detection. The breach potentially exposed personal information of individuals associated with Brewer-Porch between September 27, 2002, and December 9, 2009. Affected parties included former clients who received services during this period, as well as employees and medical providers who worked at the center. The university initiated an investigation upon discovering the decade-old intrusion but did not specify whether forensic analysis determined the exact nature of data accessed or the identity of the threat actors.

The incident impacted 1,400 individuals, comprising 727 former clients whose personal and medical information resided on the server and 641 former employees and providers whose Social Security numbers and employment-related data were stored. The university issued notifications to all affected parties in compliance with regulatory obligations, disclosing the breach despite its age. No evidence suggested misuse of the exposed data in the intervening years between the intrusion and its discovery. The compromised server was being prepared for secure decommissioning when the historical unauthorized access was identified, though the university did not detail whether other systems were investigated for related compromises. Response efforts focused on transparency and fulfilling notification requirements rather than containment measures due to the elapsed time since the actual breach occurred.