Cyber Incident Victim: North Carolina State University
Date:
Jun 2016
Location:
United States of America
Summary
North Carolina State University suffered a data breach when an attacker accessed a university email account via a sophisticated phishing scam, compromising personal information including names, addresses, student ID numbers, and Social Security numbers of approximately 38,000 individuals. The institution responded by forming an incident response team with law enforcement, conducting forensic analysis, removing compromised data, and implementing enhanced security measures such as mandatory credential changes and two-step verification. Affected individuals were offered a year of free credit monitoring services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On June 3, 2016, Google notified North Carolina State University of suspicious activity occurring within a university email account used for conducting official business. University officials immediately launched an investigation, determining the account had been compromised through a sophisticated phishing scam. Forensic analysis revealed the account contained a file from 2013 storing personally identifiable information, including names, home addresses, university ID numbers, and Social Security numbers. An additional email within the account held further names and Social Security numbers. The compromised data affected approximately 38,000 individuals, primarily consisting of records from the 2013 file. No specific details regarding the duration of unauthorized access or the exact phishing mechanism were disclosed in public reporting.
NC State established an incident response team collaborating with law enforcement agencies to address the breach. The university conducted comprehensive computer forensics, systematically scanned the affected account to identify all exposed data, and developed notification lists for impacted individuals. Officials permanently removed the compromised files and emails from the account. Affected individuals were required to change their account credentials, and the university implemented mandatory two-step verification for account access while enhancing security protocols for other campus systems housing sensitive data. All 38,000 victims received one year of free credit monitoring services. The university emphasized its commitment to protecting confidential information and continued monitoring the situation with law enforcement, as stated in a July 8 press release by the Assistant Director for News and National Media Coordinator. No additional technical specifics regarding attacker methodologies or infrastructure alterations were publicly documented.