Pace University

Summary

An Arizona man was arrested for hacking into over 1,000 email accounts at two universities, including Pace University, by exploiting password reset tools to gain unauthorized access. The attacker compromised linked social media and online service accounts, harvesting confidential information and searching for explicit content in victims' emails. The New York-based institution suffered the most significant impact, with over 1,000 accounts breached, prompting coordination with federal authorities. The perpetrator also attempted unauthorized access at 75 additional colleges, successfully changing credentials at another university before being apprehended through federal charges.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In April 2023, federal authorities arrested Jonathan Powell, a 29-year-old Phoenix resident, for orchestrating a hacking campaign targeting universities including Pace University in New York and an unnamed institution in Pennsylvania. The criminal complaint filed in Manhattan federal court detailed that Powell used password reset tools to compromise email accounts, successfully changing passwords for 1,050 accounts across both universities between at least October 2015 and September 2016. At Pace University, he attempted password resets for 2,054 accounts, succeeding with 1,035, while at the Pennsylvania school, he targeted 220 accounts and compromised 15. Powell extended his efforts to student directories and login portals of over 75 additional colleges. After gaining access, he exploited linked social media and online service accounts—including Facebook, LinkedIn, and Google—to mine confidential user data. Prosecutors noted he specifically searched compromised accounts for sensitive material, using keywords like “naked” and “horny” in one student’s Gmail to locate potentially embarrassing content.

Pace University confirmed it was the New York institution referenced in the complaint, stating it had detected the breach and proactively contacted the FBI and the Manhattan U.S. Attorney’s Office. U.S. Attorney Preet Bharara characterized the case as a national wake-up call for educational institutions regarding cybersecurity vulnerabilities. Powell was arrested in Arizona on federal computer fraud charges and released following an initial court hearing in Phoenix. The complaint did not specify the total number of victims impacted by his social media account takeovers or the extent of data exfiltrated beyond the confirmed email compromises. Authorities highlighted the operational scope of the attacks but did not disclose remediation steps taken by the affected universities or whether stolen data was misused.

Sources

Sources available to members: 1 source.