CLARION, Pa. (EYT) – Clarion University was notified of an email compromise that occurred because of a criminal phishing scam that compromised two email accounts in the registrar’s office.

The unauthorized individual or individuals had access to the accounts between October 7 and October 10.

“Clarion University is committed to data integrity and privacy protection,” said Communication Manager Tina Horner. “The email compromise potentially exposed Social Security and/or driver’s license numbers belonging to 408 students. Following discovery of the incident, Clarion University immediately initiated an investigation and suspended the email accounts that were compromised.”

At this time, the university said there is no evidence that an unauthorized individual has tried to retrieve or use personal data. The university sent notifications to each potentially impacted student encouraging them to remain vigilant to the possibility of fraud and identity theft by reviewing account statements for any unauthorized activity. The university will also provide identity/credit monitoring service free of charge to each potentially impacted student to assist with the resolution of any identity fraud.

“Information security is a top priority for the university, and we are undertaking a number of actions to prevent this kind of criminal activity from recurring,” said Horner.

Remaining messages are under review for other internal data such as the student ID number and academic information.

University  reactions to the email compromise included the following:

• A postal letter notification to each individual included details to access two services to help safeguard personal information from misuse.
• Specialized assistance via an identity restoration agent to assist individuals who believe that there has been fraudulent use of their information.
• Optional Identify and Credit Monitoring fraud detection service. Impacted individuals may enroll in a one-year, complimentary membership for a comprehensive identity and credit monitoring service.
•  The affected emails were taken offline within 24 hours of the unauthorized access.
•  Clarion University has launched a comprehensive information security program to increase the security position of the university.
•  Clarion University has accelerated information security projects for key risk areas.
• The compromise involved access to an email account, not the university’s data systems or servers.