Like so many financial institutions of late, the University of Connecticut has had a server storing personal data breached. Also like those financial institutions, they report nothing bad happened. Right.

Is it possible that someone went to all the trouble of placing a rootkit on this server but didn't even look around? The university appears armed with plenty of explainations why nothing could possibly happen.

Explanation 1: "Personal information was not in a readable format." Notice they didn't say "encrypted" anywhere.

Explanation 2: "The program failed an attempt to create a backdoor route to the server." Considering someone installed a rootkit, it sounds like there already is one.

Explanation 3: "None of the potentially exposed information involved electronic patient records at the health center." They don't have a network?

Explanation 4: "The program did not appear to be heavily used." Did they say, "appear?"

Explanation 5: "The server was breached during a broad Internet attack rather than a specific attack on the university." That isn't exactly something to brag about.

The breach was discovered when someone tried to access the server last Monday with an "illegal password." It was immediately taken off-line.