LINCOLN — University of Nebraska-Lincoln police needed to look no further than their own campus to identify a suspect in a hacking incident last week.
UNL Police Chief Owen Yardley said a UNL undergraduate student was a suspect in the security breach of the Nebraska Student Information System database, which serves the University of Nebraska and the state colleges. The breach may have exposed the financial information and Social Security numbers of thousands of NU students, alumni and employees.
The student's computer and related equipment were confiscated and are being analyzed by police and the FBI, officials said.
Yardley said the forensics process for a computer crime can be time-consuming and the student's name would not be released before an arrest is made.
Joshua Mauk, NU information security officer, couldn't say whether more than one person was involved in the incident.
“The information we had led to this individual,” he said. “I can't comment on whether other individuals are involved at this time.”
The security breach was discovered May 23. Mauk said the ongoing
investigation prevents him from describing how the breach was detected.
An NU website set up to answer questions about the breach has this description of the incident:
“This was a sophisticated and skilled attack on our system that was discovered and shut down within hours of its discovery. The NeSIS is the electronic database that contains personal records for students, parents, employees, alumni and applicants of the university's four campuses. It manages nearly every aspect of the student experience, including admissions, housing and course registration.”
Mauk said his staff have fielded hundreds of e-mail questions about the breach, but so far no incidents of fraud or identity theft have been reported.
Yardley said the student was identified by NU Computing Services personnel through IP (Internet Protocol) addresses used to access the system. Mauk said computing staff examined thousands of lines of system logs to ferret out the information.
Yardley also said NU delayed announcing the security breach for 48 hours at the request of police, as investigators worked to verify the individual's identity, and legal steps were taken to seize the property.
NU is creating a toll-free phone line to answer questions about breach. The line will become available Friday. Meanwhile, updates continue to be made at a website about the security breach.