The admissions websites were vulnerable for over nine hours yesterday before the hacker instructions and the admissions letters were taken down.
But during the narrow time window, according to a thread on Business Week Online technology forum, several applicants managed to follow the hacker directions and read the admissions office response letter.
HBS requires students to submit their applications and recommendations electronically using ApplyYourself, an online application and decision notification system.
An anonymous hacker known as rookbond, †who defined himself as a male who specializes in information technology and software security, posted the instructions on Business Week Online technology forum at 12:15 a.m., early yesterday.
⁉ know everyone is getting more and more anxious to check [the] status of their apps to HBS, †he wrote. ⁓o I looked around on their site and found a way. ‼p>Steven R. Nelson, executive director of HBS Master of Business Administration (MBA) program, said the letters were taken off the site early yesterday.
⁔hese were just internal administrative devices, †Nelson said.
Len Metheny, chief executive officer of ApplyYourself told The Crimson that his company notified the half-dozen schools that were affected and put them on alert yesterday morning.
⁔he problem has been resolved since 9:45 this morning, †he said. ⁗e made some changes to the system to prohibit access to that information. ‼p>Metheny also noted that individuals could only access their own personal admissions responsesot those of other applicants.
Business Week officials set out to expunge the hacker comments from the website yesterday morning, said Kimberly Quinn, Business Week director of communications.
⁁s soon as we were informed of the situation, we deleted the post immediately, †she said. ⁁nd any other directions that anybody else posted...we deleted those right away, too. ‼p>Nelson said HBS and Business Week did not contact each other about taking the posts down.
Before the online discussion on Business Week forum was deleted, other students reported that they had also accessed admissions decisions from MIT Sloan School of Management, the Stanford Graduate School of Business, and Duke University Fuqua School of Business.
Managing Director of MBA Admissions and Financial Aid at HBS Brit K. Dewey posted a statement on Business Week online forum last night directed to current applicants.
⁈BS decision information housed within ApplyYourself is neither complete nor final until our application notification dates, †she wrote.
Dewey also emphasized in her online post that students†applications and recommendations have remained secure.
⁓uch behavior is unethical and inconsistent with the behavior we expect from high-potential leaders we seek to admit to our program, †she added.
Nelson said that HBS has not decided how to deal with applicants who accessed the site yesterday, nor would he confirm whether HBS knew the identities of these applicants.
⁔his is a matter wee taking very seriously, †he said.
HBS offers students three application rounds, with deadlines in October, January, and March. The admissions office sends out responses in January, March, and May, respectively.
Applicants who could access the website using the hacker technique expected to hear a decision from HBS on March 30.
Quinn said that Business Week does not know the identity of rookbond, †who told the online forum yesterday that he had used his own techniques to find out his own admissions status at HBS.
Sanford Kresiberg, a business school admissions consultant who follows developments at HBS closely, said that ⁴his was probably not HBS fault, but the software vendor. ‼p>Kresiberg added that the Wharton School at the University of Pennsylvania, as well as Cornell College, had experienced problems with online admissions programs in recent years.
⁔hings could be worse, †he said.
⁓taff writer Daniel J. T. Schuker can be reached at dschuker@fas.harvard.edu.