Undisclosed Data Breach Helped Enable Phishing Scam At University
from the how-the-data-gets-used dept
Officials at Indiana University have concluded that a 2006 phishing attack against university members was made possible by an earlier breach of one of the university’s main servers. This all came to light when one recipient of a phishing email — a cybersecurity Ph.D. student — wondered how an attacker could get his university email address, since he had never given it out to anyone. After requesting documents under the Indiana Public Records Act, the student discovered that the university had previously suffered an undisclosed breach, which is how the attacker obtained his information. This simple story underlines some important points. It shows that breaches aren’t harmless; even if the stolen data isn’t immediately used for direct fraud, it’s likely to be used in other ways down the road. If stolen data can help a phisher do a better job of personalizing an email to make it look more legitimate, then that stolen data has value. The case also demonstrates the importance of disclosure. People whose data is lost need to be aware of it so that they can be on guard for fraud. When we hear about massive losses of data, such as the incidents at the Veterans Administration or TJ Maxx, it’s easy to get lost in the staggering numbers and think of it all as an abstraction. But this incident shows, along with others before it, that breaches do have real consequences for the victims.
Comments on “Undisclosed Data Breach Helped Enable Phishing Scam At University”
What good are just plain email addresses? They still need your permission to spam you. Thats the law.
The critical factor of permissions is often overlooked here. Why should you give up your personal information in the first place, to anyone? The answer is that you’ve also given them permission to use it.
Those who receive your personal information as the result of a data breach do not receive with it your permission to do anything. Its just useless junk data.
Without the force of consent, these bits and bytes have no value. I dont see whats the big deal
Re: Re:
are you an idiot? or just trying to make a joke? I don’t get it.
Humm
Well if you think about it like this. An old lady gets her info injected into the world, say just an email address, name and some other basic stuff. She then gets an email from someone who says they know her and have all the info to prove it. This person could ask for a lot of things from this lady. She has trust for this person since they “know her”. Not knowing that her info was leaked, she believes all of it.
Your info will be leaked, it’s a problem that is almost impossible to avoid. The point of the post is that if your info is leaked you should be made aware of it. So that if you get an email from someone who “knows you”, you can tell em to f-off. Otherwise anyone could be put in a situation of trust and give up things they should not. Permission is not something criminals or even gray area companies will care about. They will use the info regardless.
Seroiusly Anonymous Coward
Since when do spammers care whether or not they are running a legal operation, or using legaal phone numbers?
Learn to read first.
Wow. I love it when people are so exited to post first that they forget to read the article.
This was not spem, It was Phishing.
In case Mr. Anon up there doesn’t know the difference. Spam is for the most part advertisements sent en mass to get you to buy something. spammers make money off the clicks. And no, they don’t wait for your permission before sending you spam. If they did it wouldn’t be spam, rather it wold be a legitimate opt in advertisement.
PHISHING on the onther hand is an attemt to gain your trust to the point that you will be willing to disclose personal information that could be used to compromise your or somebody elses security.
Working for AOL we were constantly recieveing mail about our secure ID’s. This was an attempt to comprimise our servers.
Back to the post. I would have to agree with Joe on this one. The act of not informing students who’s data was lost is pure negligence. They had a right to know so they could take the steps necessary to ensure they did not become victems of fraud.
Re: Learn to read first.
spam is unsolicited email. phishings are unsolicited.
email spam blockers block a number of things. I’m going to guess they try and block as much phishing as possible.
hmm sounds like spam to me
Learn to read first
Dear Anonymous,
yes, you sure can call phishing spam. Nonetheless, that simply isn’t the subject of this article.
What the article does say:
1) The more info you have about a person/user, the better your phising attempt will be : “breaches do have real consequences for the victims”.
2) People who’s information has been ~stolen~ should be informed, in order to take appropriate measures or simply be on the look out.
Spam is definitely unsollicited and mass mailings to non-optin users is illegal in most countries.
You might think about googlin’ for some definitions…
Re: Learn to read first
I think I know the definitions well enough, thanks. I’m sorry you disagree with them.
The subject of the email is phishing, which I called spam. Spam and phishing are about the same. You think all those unsolicited ads are for legit businesses? I bet you’ve never responded to one. How do you know theyre not scams also? As soon as you buy rxm3ds with your credit card number, theyll go to town with it. The difference between phishing and spam is only a minor matter of technique.
And my points are still relevant, which is that in both cases it is people in possession of data that they are not authorized to have, used in ways they were not authorized to use it. The real problem here is that they have it and are using it, not that someone gave it up–willingly or negligently.
Stopping leaking of information is impossible. Utterly impossible. All you can do is create an ineffective chilling effect on industry by creating a climate of hostility towards data breaches and making people less likely to enjoy the fruits of the generosity with data.
You can’t stop the spammers either but you can create a chilling effect if you’re vicious enough.. and thats one industry we wouldnt mind chilling.
So pick your target.
Re: Learn to read first
Or better yet, use your brain! So frustrating to read some of these posts from people that shouldn’t be able to tie their shoe, let alone type bla bla bla on a keyboard. My grammar may be bad, but at least I can consider things in a meaningful way.
Allow me to produce the pertinent analogy:
Guns dont kill people, people do.
OK so personal information doesnt cause phishing, people do. So one might propose to stop the people that phish.
Then one might say ‘hold on! the jerks that lose control of their guns and let kids and criminals use them to kill people are the real criminals’. This is the state of the art in data-breach discourse.
I am merely taking it one step further. Guns are not data. Information wants to be free. Trite, but true, I think. Go ahead and try and stop it from being free. Nothing is more futile.
The guns dont jump out of their gun safes on their own accord. Since data does, it requires a different treatment.