LCCC Security Breach

Lorain County Community College has recently learned that a sophisticated computer hacker was able to breach two of its servers in an effort to pirate available server space.  When this breach occurred, LCCC’s system detected the downloading of application files and a virus alert was initiated. The College’s Information Systems and Services staff immediately shut down the servers and blocked access. An internal investigation suggests that the breach was not an attempt to extract any data, but to gain access to server space.  The College has brought in computer forensics experts and is working with the FBI to investigate this incident further.

One of the servers that was impacted hosted the data for the library identification card system.  Some of the records for students, community users and employees contained Social Security numbers.  This ID card system is a separate system from LCCC’s overall college records and databases, which were not affected.

While we have no evidence to suggest that the hacker accessed files from the ID card system, we are taking aggressive precautionary steps to protect those whose records are on that server. LCCC will contact everyone whose personal information was contained in the ID card database by letter. We have contracted with Equifax, at no cost to individuals, for one year of credit monitoring and ID theft protection insurance.

Those affected may contact our Equifax Personal Solutions representative at 800-704-1168, Monday through Friday from 8:00 a.m. to midnight EST for more detailed information and assistance with plan enrollment.  

If you received a letter from LCCC regarding this issue, please click here for enrollment instructions.

LCCC is committed to maintaining the privacy of database information and takes many precautions for the security of personal information.  In response to incidents of theft like this one and the increasing number of Internet-enabled computer attacks, LCCC is continually modifying its systems and practices to enhance security of sensitive information. We sincerely apologize for the inconvenience and concern that this may cause you. 

Frequently Asked Questions

When did the security breach occur?
The two servers were accessed during the Thanksgiving holiday. The College’s Information Systems and Services staff immediately shut down the servers and blocked access. An internal investigation suggests that the breach was not an attempt to extract any data, but to gain access to server space.

Who was affected by the security breach?
One of the servers included data for LCCC’s library identification card system. This ID card system is a separate system from LCCC's overall college records and databases, which were not affected.

While we have no evidence to suggest that the hacker accessed files from the ID card system, we are taking aggressive precautionary steps to protect those whose records are on that server. LCCC will contact everyone whose personal information was contained in the ID card database by letter. We have contracted with Equifax, at no cost to individuals, for one year of credit monitoring and ID theft protection insurance.

How do I know if I was affected by the security breach?
Everyone affected has been mailed a letter on Lorain County Community College stationery. The letter was mailed to everyone whose Social Security number was on the server database. If you did not receive a letter regarding this from Lorain County Community College, you are not affected.

I recently moved, so how would I be contacted?
If you filed a change of address with the post office, the letter will be forwarded to you. If you did not file a change of address, the letter will be returned to Lorain County Community College. We will verify the addresses on any letters that are returned. The letters will be resent to the corrected addresses.

I never received an LCCC identification card.  Why did I receive a letter?
Records are created in LCCC's admissions and registration process for assessment-test results and other activities. These records are created even if you do not complete the admissions process.

I received a letter. Am I a victim of identity theft?
There is no evidence that any data was accessed from the affected servers. LCCC is taking these steps as a precautionary measure to guard against identity theft.

How does the identity-theft protection work?
The service provides unlimited access to your Equifax Credit Report and sends automatic alerts within 24 hours of key changes to your Equifax Credit Report – such as when someone tries to open credit in your name.   You can also establish a fraud alert, which notifies creditors of possible fraudulent activity within your report, and requests that all creditors contact you before establishing any account in your name. In addition, Equifax provides up to $20,000 in insurance for any costs associated with an identity theft.

You may register online, by phone or by mail. The access code included in your letter enables you to subscribe to these services at no charge for one year. 

• Click here for Equifax enrollment instructions.

Why doesn’t LCCC automatically sign me up for the identity-theft protection so I don’t have to do it?
The law does not permit Lorain County Community College to order credit reports for this purpose. In addition, you will need to verify your identity as part of the enrollment process.

Can I get a list of everyone affected so I can check for friends or relatives at LCCC?
For privacy reasons, we cannot release the list. However, everyone who was affected was mailed a letter.
 
What should I do if I have been a victim of fraud and believe it may be tied to this incident?
If you have been a victim of fraud, and believe that it is due to this incident, please file a report with LCCC Campus Security at (440) 366-4053 or on-line at safe@lorainccc.edu. The College will share that report with the local FBI to assist with their investigation.  For additional information on how to further protect your personal information, visit the Web site of the U.S. Federal Trade Commission at www.ftc.gov/idtheft.

How could the College let this happen?
This hacking incident epitomizes the national trend that is plaguing colleges and universities due to their robust systems and server capacities. According to the Privacy Rights Clearinghouse, educational organizations accounted for nearly one-third, or 31%, of all US data-breach incidents during the past three years. 

Hackers, such as the one that accessed LCCC’s servers, are extremely sophisticated in identifying those systems with such capacity. About 58 percent of college IT officials have dealt with at least one computer-security incident in the past year, according to a survey by CDW Government Inc. and Eduventures, two IT consulting firms.  The increase in cyber attacks on college campuses has dramatically increased between 2006 and 2007 with a 67.5% more incidences reported in just one year.  LCCC’s system has not experienced any hacking or cyber attack incident in the past.  The Chronicle of Higher Education in December 2008 reported that the good old days are gone when computer hackers were mainly done by hobbyists who launched attacks for fun. Today, international hackers are professional criminals with tremendous sophistication that enables them to create penetration tactics through viruses and software applications.

The security issues with the affected LCCC servers have been rectified, and LCCC is working with network security experts to establish new security procedures for the College. Also, we currently have the situation under investigation by computer forensics experts and the FBI.

Who should I contact if I have additional questions?
Contact our Equifax Personal Solutions representative at 800-704-1168, Monday through Friday from 8:00 a.m. to midnight EST for more detailed information and assistance with plan enrollment.  You may also e-mail your questions directly to Lorain County Community College at creditfaqs@lorainccc.edu.  For media inquiries, please call 440-366-7073.