SCAD suffers data breach, but those impacted are limited

‘Unauthorized user’ accessed personnel files, university says.

A cyberattack on The Savannah College of Art and Design has resulted in a “limited number” of current and former students and employ- ees vulnerable to identity theft after an “unauthorized user” accessed personnel files, according to a statement from the university.

“After a forensic investi- gation, SCAD has reason to believe that a limited number of files containing personal information of certain cur- rent and former students and employees were accessed by the unauthorized actor responsible for the incident,” according to the statement. “SCAD has notified all indi- viduals whose information is involved in the incident in accordance with applicable law to share additional information and resources for how they can help protect their information.”

A former employee who was impacted received an email stating their social security, birthday and name were involved in the leak. SCAD offered to pay for an identity protection service, and to work with impacted individuals until the issue is resolved.

The cyberattack hap- pened last month, but quick action from SCAD resulted in a quick shutdown of the illegal activity, according to the university. A statement from SCAD’s spokesperson said the school worked with a third-party cybersecurity consultant and is cooperating with an ongoing crimi- nal investigation.

“SCAD is constantly adapting and implementing best practices for cybersecu- rity. Due to the university’s early detection and rapid response, the incident had no operational impact to the university,” according to the statement.

The statement added that the safety and security of students and employees is a top priority.

“The university will continue to adapt and imple- ment enhanced safeguard and technology security measures to further protect and monitor our systems.”

R an s omware attacks, or stealing private data in exchange for money, on higher education institutions are on the rise, according to a report from the industry news site Inside Higher Ed. According to a 2021 survey, 74% of ransomware attacks on universities are successful. According to a report from Forbes, the average university pays more than $100,000 to recover stolen data during ransomware attacks.

SCAD did not state whether the cyberattack the school suffered was ransomware.