Over the weekend of March 2, hackers breached the Hamilton College admissions database, gaining access to admissions materials from the applicants of the Class of 2023. According to
The Washington Post
, a hacker also accessed the admissions system at Grinnell College and Oberlin College in the same time frame. The College has launched an investigation into the incident.
Hamilton discovered the breach on the morning of Monday, March 4, when an admissions employee realized their password had been compromised. Admissions quickly discovered that the hackers had accessed the database with that employee’s password and that the hackers had attempted to send an email to Hamilton applicants.
Due to security restrictions in place for sending emails, the hackers’ attempt to send an email to the Hamilton Class of 2023 applicants — which they allegedly did successfully at Grinnell College — failed. One applicant confirmed receiving an email that appeared to be from the hackers that afternoon. Since then, admissions has heard from only a few other applicants who received similar messages.
Hamilton immediately launched an investigation into the incident. The College also wrote to applicants, alerting them to the suspicious activity and to be wary of unusual emails offering to sell applicant information.
“The investigation continues with assistance from law enforcement, cybersecurity professionals and forensics experts,” said Associate Vice President for Communications Mike DeBraggio. According to the
Washington Post
, Hamilton contacted the FBI regarding the incident.
Applicants of the Class of 2023 were informed that no changes to their applications had been found. Hamilton also sent an explanatory email to the school community on March 6. Information Security Officer Jerry Tylutki assured students in the email that, “Financial aid records, current student records, and employee information are stored in a completely different system and were not affected by the incident.”
Although the hackers accessed some parts of the applications, it appears that they were not able to reach more sensitive personal information. A statement posted on Hamilton’s website says that “[c]omponents of students’ applications for the Class of 2023 may have been accessed illegally, but data such as credit card information and social security numbers are encrypted in our database, and there is no evidence this information was obtained.”
Hamilton uses the software system Slate to manage their admissions data. Alexander Clark, the chief executive officer of Technolutions Inc., said that Slate had not been compromised and that hackers gained entry to the system through the affected colleges’ password-reset system, not through Slate itself.
As for now, Debraggio said the college has “reminded [applicants] to be wary of suspicious emails, particularly any with questionable content that appears to be from Hamilton.” Hamilton is continuing their investigation and working to improve their security of applicant and student information. Hamilton says it will continue to update applicants as the investigation unfolds.
