http://www.udel.edu/PR/UDaily/2006/jan/breach012506.html Jan. 25, 2006 Two recent computer security breaches at the University of Delaware have resulted in the possible exposure of names and Social Security Numbers that were stored on the machines. A computer in the University's School of Urban Affairs and Public Policy was hacked, and a back-up hard drive in the UD Department of Entomology and Wildlife Ecology was stolen. The computer in the School of Urban Affairs and Public Policy was attacked sometime between Nov. 22-26 by an unknown hacker, and it contained a portion of a database that included Social Security numbers for 159 graduate students. "Since the incident, those affected have been notified, the file has been removed from the computer, and we have taken steps to properly secure the system," Jeff Raffel, director of the school, said. A back-up hard drive was stolen from the Department of Entomology and Wildlife Ecology some time between Dec. 16-18, and a police report was filed Dec. 19. A valuable microscope worth nearly $6,000 and belonging to Judith Hough-Goldstein, professor of entomology, also was stolen, and it is believed the theft of the hard drive was an afterthought. The hard drive contained personal information on a few individuals, and Jack B. Gingrich, a postdoctoral fellow in the department whose hard drive was stolen, has informed all those involved. The University's policy is to notify all individuals if their personal information may have been compromised following such incidents, and in both cases, letters have been sent to everyone whose personal information may have been compromised. The letters informed them of the breach and shared information on how to combat identity theft. It is unknown whether any personal information was actually acquired in either case. Individuals with concerns about identity theft may visit a special web site prepared by Information Technologies at [www.udel.edu/security/identitytheft.html]. UD's Office of Information Technologies has conducted a campuswide campaign to help departments protect sensitive personal nonpublic information (PNPI), such as Social Security and credit card numbers. Every University department was visited and advised about proper security for stored PNPI. Information Technologies staff also stressed collecting such information only when required and reiterated the responsibility of each employee to follow UD policy, Delaware laws and federal laws and regulations for the processing and safekeeping of confidential, personal information. "In every department, those individuals who are responsible for maintaining records must understand that they are responsible for assuring compliance with the Family Educational Rights and Privacy Act (FERPA) and other laws that govern the use of PNPI," Susan Foster, vice president for information technologies, said. "This includes not only the proper use of PNPI but the responsibility to secure systems in which it resides," she said. Although the University has moved away from using Social Security Numbers as identifiers, some older databases that University departments and units set up in the past may still have such information. Information Technologies has posted guidelines aimed at helping departments secure PNPI and make sure they are in compliance with the University policy and the law. Those can be found at [www.udel.edu/ssn/guid.html]. The guidelines direct departments to ensure the privacy of PNPI by encrypting electronic transmissions, not storing PNPI locally and protecting PNPI when working from home or outside the University. Members of the University community with questions about uses of PNPI should call the Information Technologies Help Center at (302) 831-6000 or send email to [consult@private]. Additional information is available at these sites: * Protecting Personal Non-Public Information [www.udel.edu/ssn/]; * UD Computer Security [www.udel.edu/security/]; and * Responsible Computing: A Manual for Staff [www.udel.edu/ecce/staff.htm]. _________________________________ InfoSec News v2.0 - Coming Soon! http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Fri Jan 27 2006 - 02:52:41 PST