Purdue to notify those whose information may have been online

Class rosters and a grade sheet for three 100-level math classes had been inadvertently stored on a Purdue Web server that, while not generally visible to the public, could have been accessed by entering specific search terms into some Web search engines, said Michael G. Carr, chief information security officer for Information Technology at Purdue. Information included data such as a Purdue identification number or Social Security number, class level, academic major or grades.

Carr said the files were pulled from the server and are no longer accessible. Those whose information was included in the files will be sent a letter from Purdue's Department of Mathematics to explain the incident and steps that can be taken to ensure the information wasn't compromised. The department also has created an informational Web site.

"It appears that these files were created in order to give the instructor access to course information," Carr said. "There was no intent for any of these files to be publicly available."

The files included information on students who were enrolled in three 100-level math courses in the fall of 1999, spring of 2000 and summer of 2001.

"Social Security numbers are no longer used at Purdue in faculty, staff and student records unless that information is absolutely necessary or required by law," Carr said. "For example, Purdue ID numbers are now used in place of Social Security numbers for all course rosters and grade reports. For information in which Social Security numbers are not required, Purdue will discontinue their use by the end of this year."

Additionally, Purdue is investing more than $75 million in the OnePurdue project, which will combine and modernize business, student information and human resources databases and business processes. Carr said OnePurdue will integrate systems and applications to reduce the number of places where sensitive information is stored, making it easier to safeguard or encrypt data.

Carr also said that it was important for everyone — whether involved in this incident or not — to monitor their credit reports and financial statements.

"There are three credit agencies that, by law, must provide all consumers with a free review of their credit report every year," Carr said. "The best way to track this is to alternate among them every four months. A handy way to remember to request a credit report at least once a year is to do it on your birthday."

The credit agencies — TransUnion, Experian and Equifax — can be accessed online. To request your credit report by phone, call (877) 322-8228; your reports will be mailed to you.

Additional tips to help avoid personal identity theft are available from the SecurePurdue Web site.

Writer: Brian Zink, (765) 494-2080, bzink@purdue.edu

Sources: Michael G. Carr, (765) 494-7363, mgcarr@purdue.edu

Jeanne V. Norberg, Purdue News service director, (765) 494-2096, jnorberg@purdue.edu

Purdue News Service: (765) 494-2096; purduenews@purdue.edu

To the News Service home page