Compromised Employee Accounts FAQ

What does it mean when an employee’s account is considered “compromised?”

By definition, an account that is compromised is one where there is a high degree of probability that a user’s login name and password have been discovered and posted on the Internet by and for malicious use. This use can range from sending spam/phishing emails to a hacker actually being able to log into a person’s Banner account and steal or change sensitive information such as payroll direct deposit information. Because of the high risk such compromises pose, CIS has created a policy whereby suspect accounts are marked as “compromised.” Once compromised, the credentials are no longer valid and the user must contact CIS for remediation. More details on this process are explained below.

SPU email administrators monitor various notification lists and public sites to detect if and when SPU email accounts are compromised. Once we have a high degree of certainty that a compromise has occurred, we mark the SPU account as “compromised,” thereby suspending the validity of the account in question.

How was the account compromised?

In most cases, we don't know for certain.  In fact, CIS often knows less about how the account was compromised than the account owner. Sometimes, the user has responded to a phishing message or clicked a suspicious link.  Most commonly, account owners have used the same password across multiple accounts (for instance, SPU, Facebook, and Google, etc.) and one of those systems is breached.

Why would there be no notification of compromised provided to the SPU email account in question?

Automatic emails are sent to all the employee's email addresses on record whenever we mark any account as compromised; this includes the SPU email address as well as any other email addresses we have on file.  However, often the malicious user will delete any email notifications sent to the SPU email address, perhaps before the employee sees it.  If no additional email addresses are on file, the employee may see no notification;  For this reason, we strongly encourage all users to have an additional email on file: Update External Email Address.

What data was compromised?

It depends. We will work with employees to identify what data may have been compromised.  There are two main subsets of data that may be at risk:

1. Office365 (including Email, Sharepoint, OneDrive, etc.) - We can determine whether a malicious user logged in to Office 365, but may not be able to verify what they viewed or edited.  Typically, hackers use use compromised SPU email accounts to send phishing messages targeted at other SPU users.  As part of this, mailbox rules might be created to hide the suspicious activity from the unsuspecting employee. We rely on O365 email alerts to advise us when compromised accounts are being used for phishing.
2. Other Data systems (including Banner, Canvas, etc.) - We can determine whether a malicious user logged in to our Single Sign-On portal, but may not be able to determine quickly all applications that were accessed.  Specifically with Banner, we can identify what pages were loaded (in both Self-Service and Banner Admin).  Typical targets here include pay stub and direct deposit information.  If there are specific data systems you are concerned about, we can attempt to identify or verify what access may have occurred.

Was sensitive data compromised? 

If Office365 resources were accessed, the extent of data at risk is limited to what is present in email history, OneDrive, etc., as well as any third party accounts for which the SPU email address would provide access (for instance, if access to the email allows resetting the password to an online banking account).

if Banner was accessed, then pay stub and W2 information may have been exposed, including the SSN, as well as academic information (like grades) for which the faculty/staff member has access.

Will CIS provide credit monitoring?

Unless the compromised account occurs due to an institutional data breach, CIS will not provide credit monitoring or other follow-up investigation.  As noted in the Computer Acceptable Use policy, "Users must take appropriate and reasonable measures to protect the integrity, exclusiveness, and confidentiality of individual resources and account credentials."

CIS assistance only includes marking the account as compromised (removing access), initial notification, verification of whether institutional data was breached, and restoration of access.