On November 9, a significant data breach rattled Fordham University, impacting thousands of students and faculty members. The breach compromised sensitive information, including email passwords, names, phone numbers, and gender identities of both current and former members associated with the institution.
An investigation by the IT Office of Information Security and Assurance revealed that the breach stemmed from a compromise in a vendor-hosted and -managed application used by the university, leading to the exposure of approximately 4,800 accounts.
Fordham’s IT swiftly responded by forcibly logging out all vulnerable users from active sessions to safeguard their data. Affected individuals were promptly notified via SMS or email and instructed to reset their passwords as a precautionary measure.
In response to the breach, the university has severed connections with the vendor responsible, attributing the incident to outdated security practices. The IT Office stressed the significance of stringent security standards for vendors providing services to the university, emphasizing the implementation of robust security requirements over the past five years.
Several students recounted their experiences during this tumultuous period. Allison Schneider, a student at Fordham, initially dismissed the Emergency Notification System’s text, assuming it was a scam. She eventually reset her password but faced the inconvenience of re-logging into various platforms tied to her school credentials.
Nicole Braun, another affected student, faced challenges with the incongruence of the IT portal during the password reset process, enduring multiple attempts amid the pressures of midterm exams. Braun highlighted a delay in receiving school emails, causing further disruption.
The university’s IT office is actively seeking a replacement for the deactivated application to fortify the security infrastructure, aiming to prevent such breaches in the future and bolster support for the university community.
