The personal information of nearly 2.5 million Maricopa County Community College District students, employees and suppliers might have been exposed without authorization.
The district was first made aware of the security breach by federal law enforcement officials on April 29, according to an MCCCD news release Wednesday.
The district was in the process of notifying the affected parties, according to the release. It also has begun an investigation and is utilizing forensic experts to assess and strengthen the district's data systems and examine whether any sensitive information was accessed or exported.
"While we are not aware of misuse of anyone's personal information, we are providing resources to assist all of the people whose information was in these systems, including credit monitoring and other identity safeguards, managed by a nationally known identity protection firm," MCCCD Chancellor Dr. Rufus Glasper said.
The investigation involved multiple servers and systems, and an extensive review of data, operations and processes over several months, according to the release.
The investigation revealed employee conduct that did not meet the district's standards and expectations, and appropriate employment action is being taken. The nature of the conduct was not revealed by MCCCD.
As a result of the district's IT security vulnerabilities, certain sensitive information including individual names, dates of birth, Social Security numbers and bank account information, but not credit card information or health records, was exposed, the district said, though it is not aware of any evidence of actual misuse of any personal information.
After learning of the incident, Glasper ordered action on several fronts including:
Initiating immediate actions to strengthen security and take offline portions of its IT systems with security vulnerabilities until improvements could be completed;
Installing new security technology, including firewalls, real-time blocking and monitoring functionality, and other security protections;
Conducting a comprehensive review by independent experts of all IT security policies and procedures and implementing increased security measures;
Taking employment action in connection with employees whose conduct did not meet standards and expectations, and making personnel changes as warranted.
"On behalf of the district, I deeply regret that this occurred and am leading a thorough response designed to prevent this from happening again," Glasper said. "We are examining every aspect of our IT operations, and the changes underway are making us stronger system-wide."
There are 10 colleges in the Maricopa Community College system: Chandler-Gilbert, Estrella Mountain, GateWay, Glendale, Mesa, Paradise Valley, Phoenix, Rio Salado, Scottsdale and South Mountain. There are also Maricopa Skill Center and the Southwest Skill Center, Maricopa Corporate College and several satellite facilities.
Copyright 2013 CBS 5 (KPHO Broadcasting Corporation). All rights reserved.