Hacker Hits Top Business Schools

A computer hacker gained access to internal admissions records at Harvard, Stanford and other top business schools, then helped applicants log on and learn their fate weeks ahead of schedule, officials said.

Few of the people who followed the hacker's directions managed to find out if their applications have been accepted, according to school officials. But many of them could end up getting rejected now that the schools are checking to see who tried to exploit the security breach.

"Hacking into a system in this manner is unethical and also contrary to the behavior we expect of leaders we aspire to develop," said Steve Nelson, executive director of the MBA program at Harvard Business School.

The unidentified hacker tapped into Business Week's online forum early Wednesday and posted instruction on how applicants could log onto the schools' Web sites to check their admission status.

This touched off a bit of a stampede, as more than 100 applicants to Harvard alone tried to access their admission records. School officials hinted that applicants should expect to receive a rejection letter if they tried to hack into admissions records.

Dozens of business schools, including those at the Massachusetts Institute of Technology, Stanford, Duke, Carnegie Mellon and Dartmouth, were affected by the breach, with their Web sites vulnerable for roughly nine hours before the problem was fixed.

The Boston Globe reported that applicants who went to Web sites at Stanford and MIT came up empty because the schools have yet to post admissions decisions on their sites.

But that doesn't mean these applicants are off the hook.

"One of the things we try to teach at business schools is making good decisions and taking responsibility for your actions," Derrick Bolton, director of MBA admissions at Stanford, told the Globe.

All of the schools use ApplyYourself, an online application and notification program made by a Fairfax, Va., company.

Len Metheny, ApplyYourself's chief executive, said applicants could access only their own admissions records.

"There were only a small number of students who actually had a decision," he added. "For the vast majority of applicants, decisions were not available in the system to be displayed. A blank page would appear."

Metheny would not say if the company has been able to identify the hacker, who used the screen name "brookbond." Business Week removed the hacking tips from its site.

Jim Gray, an associate dean at Duke's business school, said one applicant tried but failed to search the school's Web site for an acceptance letter. He said school officials know the applicant's name.

"We're clearly looking at his application in a different light at this point," Gray said.

More than 100 applicants to Harvard tried to access the school's admissions records. "Some appeared to find a decision. Some got a blank screen," Nelson said. "But even if they got a decision, the decision isn't final until March 30."