The reports of the alleged ‘leak’ of database of about ‘one million’ Kashmir University students and teachers, with details like registration number, phone number, email address and password, by hackers has sparked an outrage and prompted the varsity to start analysis of the ‘data breach’.
The university, however, insisted that their preliminary analysis revealed that the data was ‘unmodified’.
Reports and social media users claimed that the database of the varsity was put on sale on a particular hacking forum by a ‘threat actor’ going by the name of ‘VictorLustig’ on August 6 for just $250. It ultimately deleted the thread from the hacking forum after the issue gained traction on social media.
An archival version of the thread revealed that the threat actor had shared sample data with index entries like ‘UGFormMaster2ndSemBatch2020Brchin2021’ with 61,175 entries, ‘AdmitCardsDownloaded’ with 26,521 entries, ‘AcademicDetails’ with 1,180 entries, PaymentApplicationsnew’ with 654 entries so on and so forth. It claimed that it was selling the University of Kashmir database with data breached like: ‘Students information, registration number, email, password, employees etc. More than 1M+ student details’.
The issue has triggered anger among the students and employees of the varsity, who believe that the management has not done enough to safeguard their privacy.
“It has been five days since the issue has come up on the hacking forum and nobody seems to care. The university must realise that digital theft is real and they must rise to the occasion to save our personal details from going into the hands of scamsters,” said a student not wishing to be named.
“Our personal data is on sale. It does not only impinge on ours, but the privacy of our families too,” said a female student of the varsity.
Sources in the university said that the issue of glitches in data protection was flagged by teachers to the administration multiple times in the past. “The issue was brushed aside as not important. Now, the fears of those raising the concern of data theft have come true,” said the source in the know of the things. “The breach is real,” the source added.
A Kashmir University spokesperson in a statement said that the data was ‘unmodified’.
“The alleged breach is being analysed and as per the preliminary analysis, it has been found that the data is unmodified,” the spokesperson said.
“Any breach on data (which is already accessible in public domain) is being analysed in-depth and depending upon the analysis, the university will take further action and an appropriate legal recourse accordingly,” the spokesperson added.