Dartmouth College has officially confirmed that it was the victim of a data theft incident originating from a security breach at a third-party vendor, Oracle. The incident impacted information belonging to the institution’s faculty and staff.

In a notification, the college stated it was informed by Oracle on April 17, 2024, about a security issue. An unauthorized third party had gained access to the college’s Oracle E-Business Suite (EBS) system on or around April 14, 2024. Upon receiving the notification, Dartmouth immediately took the affected system offline to prevent further access and initiated a formal investigation with the assistance of external cybersecurity experts.

Details of the System Breach

The compromised system, Oracle EBS, is utilized by the college for various business operations. The investigation confirmed that the external party successfully accessed and stole files from this environment. It is important to note that this incident was part of a broader campaign, as other organizations that use Oracle EBS have also been targeted by similar attacks. The college is working to secure the system and understand the full extent of the breach.

Scope of the Data Compromise

The data theft was limited to information pertaining to faculty and staff. Dartmouth College has explicitly stated that student information was not stored on the compromised Oracle system and was therefore not affected by this breach. Furthermore, the college confirmed that sensitive information such as Social Security numbers and bank account details were not compromised in the attack.

In response to the incident, Dartmouth is directly notifying all individuals whose information was contained in the stolen files. The college is offering two years of complimentary identity theft protection services through Experian to those affected by the data theft.

Source: https://www.securityweek.com/dartmouth-college-confirms-data-theft-in-oracle-hack/