RELATED WEB PAGE

* SecurePurdue

Data Incident - November 2007

A potential problem involving malware installed on a computer by an unknown intruder may affect 32 individuals at Indiana University-Purdue University Fort Wayne.

Nearly all of the individuals affected appear to be current or past international students.

An internal audit of a former staff member's on-campus computer revealed the presence of malware, including an e-mail-stealing "Trojan horse" that was installed through an e-mail attachment. Malware is software designed to infiltrate or damage a computer system without the owner's knowledge. The workstation was removed from the network, and the malware has been disabled.

We do not know that anyone has used this information for illegal purposes, but that possibility exists.

IPFW is attempting to contact each individual potentially affected by mail. If you do not receive a notice but would like to be sure your information was not involved, please call toll-free to (866) 597-0010.

Unfortunately, the technology that allows us to obtain and process information so easily can be misused by those with dishonest motives. Unauthorized access to computers is a global problem that concerns every business and organization. The problem is compounded by the fact that in the years before identity theft became a concern, Social Security numbers were used routinely for identification.

Purdue has discontinued the use of Social Security numbers, except where required by law.

We are truly concerned about the potential impact this may have on these individuals. Purdue implemented extensive safeguards to protect the information and privacy of our students, faculty, and staff. In fact, the process that led to this exposure has been discontinued.

The information that follows is offered to help you protect your identity.

How do I guard against identify theft?

Watch your financial statements and credit reports to check for entries that you don't recognize or any new accounts opened in your name. Even if you do not find any suspicious activity on your initial credit reports, the Federal Trade Commission recommends that you check your credit reports periodically. Identity theft information sometimes is held for use later or shared among a group of thieves for use at different times. You can request a free copy of your credit report no more than one time per year from each of the three major nationwide credit bureaus; however, you need to do so by contacting the central agency at https://www.annualcreditreport.com. You also can request a free initial fraud alert to be placed on your credit files by calling any one of the three major nationwide credit bureaus.

What do I do if I see evidence of fraud or identity theft on my credit report, credit card statements, or other financial accounts?

If you find suspicious activity on your credit reports or have reason to believe your information is being misused, file a complaint with the FTC at http://www.consumer.gov/idtheft  or at 1-877-ID-THEFT (438-4338). Your complaint will be added to the FTC's Identity Theft Data Clearinghouse, where it will be accessible to law enforcement agencies for their investigations. The FTC also will advise you on further steps to take in the event your information is being used illegally.

Why does the Federal Trade Commission (FTC) recommend waiting one month after an incident before requesting a copy of your credit report?

The FTC advises that suspicious activity probably will not show up immediately. In instances when personal information is stolen, it's best to wait about a month to order a copy of a credit report, according to the FTC's Web page, http://www.ftc.gov/bcp/conline/pubs/alerts/infocompalrt.htm. However, because it takes some time to fill out the forms you will receive, you can initiate the process at any time.

What action is Purdue taking to prevent illegal access of confidential information in the future? Purdue has directed all units on all campuses to discontinue the use of Social Security numbers in all records except those that are absolutely necessary or required by law. Purdue also has a large-scale program to improve its security under way called SecurePurdue.

Purdue is centralizing records that must contain Social Security numbers as well as conforming to a high level of computer authentication, authorization and encryption for access to these records.