A cyberattack on a University of Delaware computer system exposed more than 72,000 people to identity theft and could cost the school millions of dollars.

Hackers exploited a security flaw in Web-based software the university used and stole names, addresses, Social Security numbers and university identification numbers of current and past employees, including student workers, school officials said.

It's not yet known if they managed to copy other sensitive records from the software, which the university uses to conduct business services such as payroll.

Officials did not say how far back the stolen employee records date. The investigation is ongoing, and University of Delaware officials could not rule out the possibility that they might discover additional problems.

An information technology worker doing routine checks discovered the possibility of a problem July 22, Jacobson said. Officials believe the records were stolen a few days earlier, July 17. The university notified the FBI and has hired outside experts to help assess and mitigate the damage.

Though not required by law, the university will pay for credit monitoring for three years for those whose data was stolen. The university is sending out letters and emails to affected people.

Experts pegged the cost of dealing with the problem in the millions of dollars, said USA Today, perhaps as much as $13 million to $19 million, according to estimates calculated using the Ponemon Institute's annual study of data beach costs.