College Shuts Down Online Tools Access, Responds to Global Security Incident

On Wednesday, Oct. 21, students, faculty, and staff lost access to the college’s online tools due to a security incident that exposed PHP, a programming language used on the college’s websites and applications. That afternoon, Vice President for Information Technology and Chief Information Officer David Hamilton addressed the school community via an email from Student Affairs. In the email, Hamilton clarified that they had to revoke access to the college’s online tools as a preventive measure to protect the college’s data and services. He also clarified that other institutions around the world had to do the same.

In email correspondence with The Student, Hamilton clarified that the college’s action followed “guidance from industry experts and federal agencies to patch impacted systems immediately.” According to him, dozens of systems were vulnerable, including the college website, which is managed by Amherst, and Moodle, which is managed by an outside vendor. Hamilton explained that the action was necessary because any information contained on Moodle, such as students’ coursework, was theoretically vulnerable. Platforms that do not rely on PHP were not under threat. 

“Many of the kinds of data the college has about its faculty, staff, and students were potentially vulnerable, though this almost certainly excluded academic, employment, and financial data managed in Workday, which does not use PHP and was not noted as vulnerable,” Hamilton said. 

Hamilton also clarified that the college relies on industry-leading tools, such as CrowdStrike, to detect and mitigate attacks. “Those tools and analysis by our staff leave us with no evidence that systems managed by the college were compromised or [that] data [was] taken as a result of the incident,” he said. “Globally, some institutions did note attempts to exploit their systems, and we continue to monitor because of the severity of the risk.” He confirmed that there has been no evidence of exploitation of vulnerabilities for college or vendor-managed systems at this time. 

One of the main tools affected was Moodle, the web service used by students and professors for assignment submission, online assessments, and uploading course materials, which was unavailable all day. The college website and other tools that “smaller groups rely on” were also down for a considerable period of time on Wednesday, according to Hamilton.

The Amherst College Frost Library was one of the affected departments. In email correspondence with The Student, Head of Research & Instruction Missy Roser explained that the library’s website and the Amherst College Digital Collections were unavailable to the community during the incident, but they were able to work around other tools, such as Discover, the tool used for the Five College Catalog. 

“Our web services manager was able to give library staff an alternate URL to access Discover so we could support urgent needs, and our Research Guides didn’t go down, so that really helped the research librarians who were teaching sessions in courses that day,” Roser said. Discover, research databases, and other e-resources were not impacted because they do not rely on PHP in their system architecture. 

Roser explained that front desk staff could help the community with immediate issues. “We were able to make sure our community was able to get what they needed — in person, in a class, or by email — with workarounds for getting to our subscription research tools,” she said.

Hamilton remarked that IT’s initial assessment is that their procedures worked reasonably well in the face of an attack of global extent. “I will say that we are mindful of the impact of AI on the pace of vulnerability discovery and thinking about institutional risk and resiliency in the face of that dynamic,” he said. “We’re also not pleased with the response time of some of our vendors — most of them quickly made services unavailable to protect them, but some were much slower than others to restore them.”