A Florida college where names, Social Security numbers and birth dates were stolen by hackers confirmed yesterday (Oct. 10) that the data breach affects roughly 300,000 individuals.
In a memo two days earlier, the president of Northwest Florida State College, Ty Handy, said hackers used multiple files to piece together enough data to commit identity fraud against "at least 50 employees." Since that statement, however, the greater extent of the breach has come to light.
The hackers actually had access to the records of every single Florida student eligible for the Bright Futures scholarship during the 2005-06 and 2006-07 school years. The hackers also took the records of 3,000 employees, which included sensitive financial data, and 76,000 former and current student records.
"One or more hackers accessed one folder on our main server" between May 21 and Sept. 24, Handy said. In similar circumstances in the past, delays in notifying those affected have been criticized for leaving potential victims vulnerable and clueless. However, Florida law gives an organization 45 days from the time it learns of an attack to notify affected parties. In this case, the Niceville, Fla., school notified students and employees well before it was required to.
Thus far, the information has been used to take out personal loans from online vendors with a history of shadiness and to open a Home Depot credit card.
Handy said the security hole has been sealed and pointed out that he himself was one of the victims and empathized with others affected by the breach.
"This is a significant hassle for those whose information is used to commit identity theft ... I was one of the first seven or eight to be hit personally and I have spent several hours on the phone working with my bank and others to protect myself. It is not an enjoyable experience, and for that I apologize," the president said.
Follow Ben on Twitter.