[Important Information for Employees] Update on Unauthorized Access to Campus Accounts Case

[Office of the President]

Dear Campus Community,

The U.S. Attorney's Office based in Albany issued press releases yesterday
with pleadings in a case from 2019 involving unauthorized access to campus
email accounts.

We wrote to the campus at the time but I want to share some details and
outcomes for those who are newer to SUNY Plattsburgh.

In these cases, unauthorized access to student accounts was obtained by
individuals who used information gleaned from other sources to successfully
answer password reset questions. Once accessing personal accounts, photos,
posts, contact lists, private messages, etc. could be obtained.

Accessing other people’s accounts without their consent is a crime. We are
pleased to see these cases brought and the guilty pleas filed. In these
cases, prompt actions by our University Police and Library and Information
Technology Services areas played a key role in identifying the
individuals and advancing prosecution.

Once we learned of this in March 2019, we identified affected users
and locked accounts, directing them to reset passwords and security
questions. We have multi-factor authentication in place now for all
accounts, which requires users to authorize access through an additional
text message or phone call step.

We reached out to impacted students as well, to assist and support them.

As we wrote at the time, we recommend all users take proactive steps to
protect their accounts, resetting passwords and enabling multi-factor
authentication where available including all social media accounts and
alternate email accounts.



Other steps you can take to protect yourself:


   - Change your passwords regularly.
   - Don’t share your passwords with anyone else under any circumstances.
   - Don’t use passwords that are based on personal information about you
   or people close to you that can easily be guessed.
   - Don’t use words found in the dictionary of any language.
   - Don’t use the same password across multiple systems.
   - Don’t write your passwords down.  If you have trouble remembering your
   passwords, use a secure password manager to keep track of them.
   - Use passphrases when you can.

More on protecting your online information is located here: https://www.
plattsburgh.edu/academics/resources/technology/infosec/index.html



If you have concerns about your account, please contact the Helpdesk at
(518) 564-4433 or helpdesk at plattsburgh.edu.

Alexander Enyedi
President
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://ls.plattsburgh.edu/pipermail/critical-employees/attachments/20210210/43ec3226/attachment.htm>