"AI will not replace humans, but those who use AI will replace those who don't."
- Ginni Rometty, former CEO of IBM
For National Cybersecurity Awareness Month (and Halloween), I asked our Director of Institutional Compliance & Privacy, Kristin Roberts, to tell us about something that is keeping cybersecurity professionals up at night.
Something that is certainly unnerving right now is the increasing use of Artificial Intelligence (AI) by cybercriminals to make their social engineering attacks more believable and effective.
Malicious actors are taking advantage of Generative AI to scam people with phishing emails, spoofed voice calls, and fraudulent videos of real people. Interestingly, our annual cybersecurity training focused on this topic as well, so it is a top concern in the industry right now.
Generative AI (GenAI) like ChatGPT, Gemini, and others, can create text, images, audio, and videos. Learning from real photos, sound clips, videos, and public statements, GenAI can mimic a person’s look, sound, mannerisms, and communication style. What used to be clear indicators of phishing, such as poor spelling and grammar, are now gone and replaced with fictitious, yet believable, “deep-fake” messages from your boss, coworker, or family members.
Additionally, tools like FraudGPT and WormGPT are used to generate phishing emails, fake websites, malicious code, and even detect vulnerabilities. XXXGPT can produce malware, including remote access trojans (RATs), cryptostealers, and keyloggers; and Black Mamba can rewrite code to evade antivirus software. It’s spooky out there on the dark web.
As cybercriminals are leveraging AI more than ever to craft convincing social engineering attacks and malicious code, we, too, can use AI to help detect suspicious activity, predict threats, and automate responses at a speed and scale that human security teams could not replicate. AI can provide proactive and scalable defenses against cyberattacks by analyzing large amounts of data and identifying threats in real time. Consider the use of AI in your cyber defense to automate and enhance your processes as more and more GenAI cyber threats emerge.
Thank you, Kristin, for enlightening us about a scary aspect of AI. Again, we invite you to review the events across higher education with a view toward proactively managing that risk. As always, we welcome your comments and suggestions.
Oct 29: Data Breach: Yale New Haven Health reached an $18 million settlement over a data breach that impacted over five million people earlier this year. A Connecticut judge granted preliminary approval last week for the settlement over the data breach that occurred in March 2025. (link)
Oct 22: Data Breach: Evergreen State College in Olympia, Washington, experienced a data breach. An investigation determined that an unauthorized actor accessed a legacy file share system maintained by the college between May 21, 2025 and June 10, 2025. Files containing sensitive student information were compromised in the cybersecurity incident. (link)
Oct 21: Network Outage: In the early hours of October 20, 2025, a widespread outage at Amazon Web Services (AWS) sent shockwaves through the digital world, but perhaps nowhere was the disruption felt more acutely than in higher education. College students across the United States found themselves locked out of essential online learning platforms, unable to access syllabi, submit assignments, or communicate with instructors. (link)
Oct 14: Cyberattack: Harvard University confirmed it was targeted in the Oracle E-Business Suite campaign after the Cl0p ransomware group listed it on its leak site. The cybercrime group claimed to have leaked 1.3 TB of data allegedly stolen from Harvard University. The institute attempted to downplay the incident, explaining that the security breach appears to be limited to a small administrative unit. (link)
Oct 14: Cyberattack: The University of St. Thomas had hundreds of thousands of documents stolen earlier this year in a data breach, according to ABC13's reporting partners at the Houston Chronicle, and now a hacking group has taken responsibility. (link)
Oct 09: Cyberattack: Wilkes University experienced a data breach affecting at least 27,632 individuals. An investigation took place and on Sept. 22, 2025 it was determined that a cybercriminal gained access to sensitive information between Jan. 25, 2025 and Jan. 26, 2025. The cybersecurity incident both personally identifiable information (PII) and protected health information (PHI) belonging to current and former students. (link)
Oct 02: Data Breach: A Valparaiso University graduate living in Michigan is the lead plaintiff in a class action lawsuit accusing the university of negligence over a data breach that included names and Social Security numbers, and a slow response in alerting affected parties about the breach. The university announced on its website on Sept. 19 that it had been subject to a data breach that occurred in August. (link)
Oct 02: Data Breach: A massive data breach has led to at least eight class-action lawsuits filed against the University of Iowa Health Care and UI Community HomeCare. An estimated 211,000 patients were notified in late August that their personal information including social security numbers, birth dates, and insurance data was likely compromised in a data breach. (link)
Oct 01: Cybersecurity: Georgia Tech and its affiliated Georgia Tech Research Corporation (GTRC) have agreed to pay the government $875,000 to resolve a lawsuit alleging cybersecurity failures. Filed in August 2024, the suit accuses the GTRC, which performs sponsored research for several entities, of not meeting cybersecurity requirements in some of its contracts with the Air Force and Defense Advanced Research Projects Agency, the Department of Justice said on Tuesday. (link)
Fraud & Ethics Related Events
Oct 25: Financial Aid Fraud: Students both in person and online are taking the next steps in their educational careers to getting their diploma. But not all students enrolled are in it for the degree. Fake student enrollment is becoming a major ongoing issue for community colleges across the United States. This is resulting in millions of dollars being given to scammers who are using fake IDs to get federal and state student aid. (link)
Oct 21: Research Fraud: In early August, five researchers, four from Northwestern University and one from the University of Sydney concluded a study claiming that the rise in fraudulent academic publications is growing at a much higher rate than the growth of legitimate publications. The study adds fuel to the growing concern within academia about research integrity. (link)
Oct 15: Occupational Fraud: A former University of Iowa employee pleaded guilty to theft and fraud after an investigation by the state auditor's office revealed that he had diverted nearly $1 million in revenue from the school's physics and astronomy workshop. (link)
Compliance/Regulatory & Legal Events
Oct 22: DEI: The Trump administration has reached an agreement with the University of Virginia, according to an announcement from the Department of Justice, marking the first public university to reach a deal with the White House after months of turmoil. The university has signed on to Justice Department guidelines on federal funding and discrimination and has agreed to "not engage in unlawful racial discrimination in its university programming, admissions, hiring, or other activities," the Wednesday announcement said. (link)
Oct 21: Discrimination: A Los Angeles jury has awarded $6 million to a former Cal State San Bernardino administrator who alleged she was subjected to "severe or pervasive" gender harassment that her attorneys claim is systemic across the Cal State system. The lawsuit, filed in March 2023, alleged a pattern and practice of discrimination and sexual harassment against female employees in the CSU system in violation of the state’s Equal Pay Act. (link)
Oct 07: NCAA Compliance: [The] North Carolina cornerbacks coach was suspended, a university source said Tuesday. The first-year Tar Heels assistant’s suspension is related to extra benefits allegations that came to light in a report about the dysfunction within Bill Belichick’s UNC program by WRAL. The alleged extra benefits -- which are in violation of NCAA rules -- involved providing a player’s family members sideline passes for a game, according to the source. (link)
Oct 02: Title VI: The U.S. Department of Education’s Office for Civil Rights found the University of Kentucky violated the federal Civil Rights Act. It was based on UK’s association with the PhD Project, a nonprofit that helps students from underrepresented groups get degrees in business with the goal of diversifying the business world. (link)
Oct 01: Federal Law: For the first time since 2019, the government is shutting down after Congress failed to reach an agreement to fund federal agencies. About 95 percent of employees at the Education Department who don’t work on federal student aid will be furloughed without pay in the first week, along with thousands of others throughout the federal government (link)
Oct 01: Lawsuit Ruling: A lawsuit accusing 40 elite colleges and universities and the College Board of a price-fixing conspiracy has been dismissed. The suit had alleged that the institutions overcharged students for tuition as a result of counting the assets of noncustodial parents when making their financial aid determinations. (link)
Oct 01: Title VI: The Health and Human Services Department on Monday started the process for blocking Harvard University from receiving future research grants, three months after finding that the university violated civil rights law by failing to address the harassment of Jewish students on campus. Debarment is the government’s formal way of blacklisting contractors. (link)
Campus Life & Safety Events
Oct 30: Assault: Campus police are looking for the suspect in an alleged incident at the University of Hawaii at Manoa earlier this week. Police say a resident reported she was assaulted by an acquaintance after she invited him to her dorm room. (link)
Oct 30: Hazing: An Alberta college will be doubling down on efforts to prevent hazing among its athletes after being hit with sanctions for traditions that targeted rookie members of its volleyball teams earlier this fall. (link)
Oct 27: Safety Threat: A student at Rosalind Franklin University in North Chicago was caught with two rifles and a handgun in his dorm room and allegedly attacked a police officer who tried to detain him. (link)
Oct 27: Assault: One of two men accused of sexually assaulting a woman at a central Minnesota college pleaded guilty on Monday. According to the criminal complaint, [a] 20-year-old [man] and his codefendant, [a] 21-year-old [man], forced a student into her St. Cloud State University dorm room on Nov. 1, 2024. The two then assaulted her, charges said. (link)
Oct 27: Assault: A 31-year-old registered sex offender with a history of violent crimes has been arrested in connection with an attempted rape on the campus of Johns Hopkins University, according to reports. (link)
Oct 27: Assault: An Eastern Kentucky University football player and his father were arrested after an incident following Saturday’s game. According to court documents, [the two men] got into a fight with one of the team’s assistant coaches. (link)
Oct 25: Hazing: For the second time in a week, a fraternity on Indiana University’s Bloomington campus has been suspended after reported hazing incidents. The IU Police Department posted a crime notice involving Alpha Epsilon Pi on Friday. In it, IUPD says officers are investigating reports of "three hazing incidents that resulted in at least three injuries." (link)
Oct 25: Hazing: A fraternity at Rutgers University has been permanently closed as a result of a hazing episode that critically injured a 19-year-old student this month, the fraternity’s parent organization said on Saturday. (link)
Oct 23: Campus Protests: Three pro-Palestine protesters were arrested Wednesday night during their participation in a demonstration organized by the TAHRIR Coalition, a coalition of more than 90 pro-Palestine student organizations, against a speech from two former members of the Israel Defense Forces hosted by the University of Michigan’s chapter of Students Supporting Israel as a part of their "Triggered: Combat on College" event. (link)
Oct 23: Assault: A Towson University student was assaulted and had their tires slashed on the campus in Baltimore County after a nearby road rage incident, university police said. According to the towson university police department (TUPD), the incident occurred during the morning rush hour on Thursday. (link)
Oct 22: Bias Incident: The Department of Public Safety is investigating a bias report at Syracuse University after a student discovered offensive language targeting LGBTQ individuals and a racial slur on a whiteboard outside an office at the Newhouse at Syracuse University. (link)
Oct 22: Hazing: Two people were hospitalized after a hazing incident that reportedly occurred at Indiana University’s Bloomington campus. According to the Indiana University Police Department, the incident was first reported on Tuesday. The incident itself, however, happened during the late evening hours of Oct. 15 and the early morning hours of Oct. 16. (link)
Oct 21: Hazing: The Women’s and Men’s volleyball teams at Lloydminster’s Lakeland College campus have been benched by sanctions following a joint investigation by the Alberta Colleges Athletic Conference (ACAC) and Lakeland College involving hazing. The hazing incidents took place between Aug. 29 and Sept. 1, including an on-campus rookie party on Sept. 1, prior to the start of the fall semester classes. (link)
Oct 17: Free Speech: Newsstands for The Indiana Daily Student stood empty across Indiana University’s Bloomington campus on Thursday, after a dispute that has left student journalists and press advocates accusing the university of censorship. This week, administrators fired the Media School’s director of student media, who advised the newspaper. The director, Jim Rodenbush, said he had "no doubt" he was dismissed because he refused to order the students to stop publishing news, as he said the university had demanded. (link)
Oct 16: Sexual Assault: A University of Southern California graduate student who police say is a serial sexual predator has been charged with drugging and raping multiple women as investigators look for additional victims, Los Angeles authorities said. USC said in a statement Wednesday that it is cooperating fully with police and has taken steps to bar Weng from campus. (link)
Oct 10: Campus Safety: A student at Tri-County Technical College (TCTC) was transported to a burn center after experiencing a fireball incident during a welding class Thursday evening. It was reported that the incident occurred when the student was lighting a cutting torch and the gas had been running slightly too long before ignition, resulting in a flash. (link)
Oct 09: Free Speech: [Pepperdine University] in Malibu has closed an exhibition six months ahead of schedule, following requests from at least a dozen artists to withdraw from the show after the school removed or altered art it considered "political." The news comes amid a federal attack on nonprofit organizations whose actions or words have run afoul of the Trump administration’s ideologies. (link)
Oct 09: Shootings: The FBI office in Columbia has now joined the investigation into two shootings that happened at South Carolina State University over the weekend. The two shootings happened during homecoming weekend. Authorities said 19-year-old Jaliyah Butler died in one of the shootings, and a man was injured in the second incident. (link)
Oct 08: Hazing: McNeese State University is investigating an alleged hazing incident involving members of the Kappa Sigma Fraternity, university officials confirmed today. The alleged incident happened around 5:25 p.m. Oct. 7 at the Kappa Sigma house, according to an initial police report obtained by 7News. An anonymous tip submitted to police stated that Kappa Sigma has been hazing, the report read. (link)
Oct 03: Free Speech: UNC Chapel Hill professor Dwayne Dixon was reinstated Oct. 3, ending his suspension over alleged ties to a defunct anti-fascist group last month. The reinstatement comes after the ACLU of North Carolina, representing Dixon, threatened legal action over the university’s decision to place him on leave, writing in an Oct. 2 demand letter that it was a "textbook violation of the First Amendment." (link)
Oct 02: Threats: Nearly a dozen school shooting hoaxes at universities have been reported across the country in the past week, with at least 10 of those believed to be connected to a single group, according to an intelligence report. While these particular hoaxes, also known as "swatting calls," ended up being false alarms, experts note that these types of hoaxes are not only a serious crime with substantial penalties for those involved, but can also put first responders and bystanders at risk. (link)
Oct 01: Hazing: Attorneys representing the family of Southern University student Caleb Wilson have filed a wrongful death lawsuit against Omega Psi Phi Fraternity, its local chapters, members, and Southern University following his hazing-related death in November 2024. (link)
Oct 01: Campus Security: The Utah college where conservative leader Charlie Kirk was assassinated lacked several key public safety measures and practices that have become standard safeguards for security at events around the country, an Associated Press review has found. (link)
Oct 01: Death on Campus: A contractor died on Tuesday after an incident on the job at Eastern Kentucky University’s campus. The coroner confirms that 61-year-old Edwin Burton II, of Illinois, died while working in the basement of Telford Hall when an air conditioner unit fell, killing him. Officials are continuing to investigate the incident. (link)
If you have any suggestions, questions or feedback, please e-mail Kevin Robinson at robinmk@auburn.edu or Robert Gottesman at gotterw@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter and subscription information are available on our website.