BANGOR (NEWS CENTER Maine) — Eastern Maine Community College reported a possible data security breach Thursday when the school became aware that some computers at the college became infected with malware.
An EMCC spokesperson said they have not identified a direct loss of data due to the infection, but said it is possible that some personal information, including names, addresses, Social Security numbers, dates of birth, and some usernames and passwords associated with college domain and email accounts may be at risk.
"Out of an abundance of caution, the college is notifying some 42,000 current and former students and employees of the possibility that personal information was exposed as a result of the infection," a spokesperson wrote in an e-mail statement.
The spokesperson said EMCC reported the incident to law enforcement and is investigating the incident and the college's security protocols. The college is also following guidance from the National Cyber Awareness System to "ensure that the infection is contained and does not recur."
EMCC President Lisa Larson noted: “We very much regret the inconvenience or concern this incident may cause. EMCC takes seriously the protection of personal information, and our efforts to improve and strengthen our electronic security are ongoing. Unfortunately, institutions of all kinds around the world are increasingly subject to sophisticated and aggressive hacking tactics such as the one involved in this incident.”
The malware involved in the incident is known as EMOTET and, according to the U.S. Department of Homeland Security, continues to be among the most pernicious malware affecting the public sector. Initial infection occurs when a user opens or clicks on a malicious link or document. Once downloaded, its worm-like features result in rapidly spreading network-wide infections, which are difficult to combat.