Cyber Incident Victim: George Mason University
Date:
Jul 2014
Location:
United States of America
Summary
George Mason University experienced a malware intrusion targeting its travel booking system, potentially impacting approximately 4,400 users. Although stored names and Social Security Numbers were not confirmed to have been accessed, the institution notified affected individuals, established a support line, provided complimentary identity monitoring, and removed SSNs from the compromised system as precautionary measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 16, 2014, George Mason University detected a malware intrusion targeting its Travel Request Service application, a system used by faculty, staff, students, candidates, guest speakers, and others to book university-subsidized travel. The incident potentially affected up to 4,400 users of the system, which stored names and Social Security Numbers (SSNs). University officials, including Vice President for IT and CIO Marilyn Smith, stated there was no evidence that personal information had been viewed or accessed by unauthorized parties. The malware attack represented a potential compromise of the travel booking platform, though investigators could not definitively confirm whether unauthorized access to the system had occurred. The university initiated an investigation following the detection but found no conclusive proof of data exfiltration or unauthorized viewing of sensitive information.
In response to the incident, George Mason University notified all 4,400 potentially affected users via mailed letters and established a dedicated help line to address inquiries. The institution offered complimentary one-year memberships to ProtectMyID, a credit monitoring service designed to detect misuse of personal information. As a preventative measure, the university permanently removed all Social Security Numbers from the Travel Request Service system to eliminate future exposure risks. These actions were implemented despite the absence of confirmed data theft or viewing by malicious actors. The university maintained transparency about the investigative limitations, acknowledging the malware intrusion while clarifying that the scope of unauthorized access remained undetermined. No additional technical details about the malware’s entry vector, persistence mechanisms, or operational impact on the travel system were disclosed in the available public reporting.