On Monday, March 4, administrators at the College learned that an unauthorized party accessed the system that houses student applicant information. The stolen information contained basic demographic and admission data for the Class of 2023. This data refers to characteristics of a person such as name, address, and ethnicity, whereas admission data refers to information contained in an application for admission to the College, such as material from a Common Application or Coalition Application that was imported into Hamilton’s admission database.
Hamilton’s Library & IT Services (LITS,) upon being made aware of the situation, promptly began an investigation. Cybersecurity professionals were enlisted to assist in the investigation and additional steps were taken to immediately prevent further unauthorized access to applicant records. The College says all Class of 2023 applicants were alerted within two days of the incident.
On March 19, the College became aware that basic demographic and admission data was accessed not only for the Class of 2023 but for applicants from the previous four years as well. The FBI informed school authorities that it is investigating this incident and similar intrusions at other U.S. colleges.
There is no evidence that social security numbers, credit card numbers, or any financial aid documents were accessed by the unauthorized party.
In response to the data breach, the College says it is accelerating the timeline for planned security projects to enhance data protection on College systems storing sensitive data.
One such project includes the implementation of Multi-Factor Authentication (MFA) to enhance security in front of sensitive systems, including the MyHamilton portal. Multi-Factor Authentication is a security method that combines two forms of identification out of three possible combinations: something you know, something you are, or something you have. For example, a password is something you know, your fingerprint or face ID is something you are, and your cell phone or a passcode token is something you have.
MFA will be used for any employee who has access to sensitive data. When users attempt to log into one of these systems they must first authenticate with their password — something they know. After a successful password authentication, the MFA system will require a second form of authentication: something they have or something they are. A malicious actor impersonating a Hamilton College employee will not be able to access a sensitive system without two forms of authentication. Over the next few weeks, LITS will be reaching out to enroll and train users on MFA and to answer any questions users might have.
The Hamilton community was informed on multiple occasions via campus-wide email about the data breach in its aftermath.
“We have been as proactive as we can by sharing information as it is discovered during the course of our investigation,” said Jerry Tylutki, Hamilton’s Information Security Officer.
The FBI say their investigation into the data breach is continuing but do not share details about an open investigation with the public.
