May 20, 2005

Dear :

We are contacting you about a potential problem involving identity theft that may affect you. At least one of four Purdue computers being used to test a system enhancement was accessed by an unauthorized person or group not affiliated with the University. As a result of this illegal activity, your private information, including Social Security numbers, may have been accessed electronically. The security breach involves the information of 11,360 current and former Purdue employees, including retirees, as well as some graduate students employed by the University.

We are truly concerned about the potential impact on each of you, and with this letter will try not only to explain the problem but also arm you with skills to protect yourself against identity theft.

Unfortunately, technology that allows us to obtain and process information so easily can be misused by those with dishonest motives. Unauthorized access to computers is a global problem that concerns every business and organization.

The basic problem in the current incident is that, in the years before identity theft became a concern, Social Security numbers were used routinely for identification. Purdue began its process of moving away from using Social Security numbers beginning in 2003 when it removed the Social Security numbers from the face of Purdue identification cards.

Removing Social Security numbers from all of the University's business practices, however, is an enormous and expensive process, but we are mandating that every possible step be taken to solve this problem by the end of calendar year 2006.

Our goal is to do all we can, as quickly as we can, to prevent a recurrence. We also urge you to take steps to guard against identity theft by carefully watching financial records and credit reports. To assist you, Purdue has developed a Web site at: http://www.purdue.edu/dataincident/

As a first step, we recommend that you place a fraud alert on your credit file. A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts. To activate an alert, contact any one of the three major credit bureaus. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts. All three credit reports will be sent to you, free of charge, for your review.

The three credit bureaus are:

Equifax: 800-525-6285

Experian: 888-397-3742

TransUnionCorp.: 800-680-7289

All three credit agencies also can be accessed at : http://www.annualcreditreport.com/cra/index.jsp.

To request your credit report by phone, call 877-322-8228; your reports will be mailed to you.

Even if you do not find any suspicious activity on your initial credit reports, the Federal Trade Commission recommends that you check your credit reports periodically. Identity theft victim information sometimes is held for use or shared among a group of thieves at different times. Checking your credit reports periodically – alternating among the three credit agencies every four months – can help you spot problems and address them quickly.

If you find suspicious activity on your credit reports or have reason to believe your information is being misused, get a copy of the report; many creditors want the information it contains to absolve you of the fraudulent debts. You also should file a complaint with the FTC at http://www.consumer.gov/idtheft or at 1-877-ID-THEFT (438-4338). Your complaint will be added to the FTC’s Identity Theft Data Clearinghouse, where it will be accessible to law enforcement agencies for their investigations.

No Purdue representatives will be calling or e-mailing to ask for anyone's personal information. Call Purdue University police at (765) 494-8221 to report any individuals saying they are affiliated with Purdue and who offer to help or are requesting private information.

For more information on how to guard against and deal with identity theft, you can download the FTC's comprehensive 26-page booklet ID Theft: When Bad Things Happen to Your Good Name, which is available on the Web site http://www.pueblo.gsa.gov/cic_text/money/id-theft/idtheft.htm.

If you would prefer to have a copy mailed to you, or if you have questions or concerns, please contact the ITaP Customer Service Center at (765) 494-4000.

Purdue University truly regrets that this electronic intrusion occurred, and that it is necessary for all of us to take the precautions outlined in this letter.

Sincerely

Jim Bottum

Vice President for Information Technology