Hackers breach customer data of 2,600 shoppers at MSU online store

EAST LANSING, Mich. - Hackers have breached Michigan State University’s online store, gaining access to customer credit card numbers and other personal information, the university said.

The university on Monday began notifying customers who may have been affected by the hack. Michigan State’s information security team has corrected the site’s vulnerabilities that allowed the intrusion between Oct. 19, 2019 and June 26, officials said. The university is offering free credit monitoring to anyone affected by the breach.

“Our top priority is preventing any further exposure of consumers’ information by sharing resources and tools to help protect them from these cyber criminals,” said MSU Interim Chief Information Security Officer Daniel Ayala, in a news release Monday. “We are deeply sorry and understand the concern of those affected. We are working around the clock to make it right.”

Hackers used code to expose the names, addresses and credit card numbers of about 2,600 shoppers at the online store that sells the school’s branded merchandise. No social security numbers have been exposed.

Michigan State was the target of a Memorial Day hack of Department of Physics and Astronomy servers. The hackers demanded an unspecified ransom. MSU officials refused and hackers began publishing stolen information, including a pizza order receipt, a student’s passport, and a letter from the university offering someone a postdoctoral research associate appointment.