Comment by joergsauer

Interesting article, but more details on how the attack succeeded would have been worth reading. Was it a problem with password reset in the Harvard email system, i.e. was publicly available information used to answer a verification question in combination with an arbitrary email address? Or was it a social engineering attack, i.e. did the attacker convince somebody at Harvard to initiate a password reset using this information?