The University of Delaware says confidential personal information about more than 72,000 current and past employees has been compromised in a cyberattack.

The university notified the campus community of the attack Tuesday morning, calling it a criminal act. The university says the hacker or hackers responsible took advantage of a vulnerability in software acquired from a vendor. The information that was taken includes names, addresses, Social Security numbers and employee identification numbers.

The university sent letters on Monday notifying those who were affected by the attack and offering them free credit monitoring. Those who have UD email accounts were also notified via email.

The university says the FBI and a private computer security firm are investigating the attack.