April 24, 2007
175 told of possible computer security incident at PurdueWEST LAFAYETTE, Ind. - Purdue University is informing 175 people who were students in fall 2001 that a Web page containing information about them was inadvertently available on the Internet.
The page, which was no longer in use but was on a computer server connected to the Internet, contained names and Social Security numbers of students who were enrolled in a freshman engineering honors course and were scheduling to meet with advisers. Although forgotten, the page had been indexed by Internet search engines and consequently was available to individuals searching the Web.
The page has been removed and, at Purdue's request, Yahoo and Google have removed the page from their indexes and cache. Letters are in the mail to those potentially affected.
"We have no direct evidence that any unauthorized person downloaded data or used it for illegal purposes, but we are trying to alert every individual whose information was in the file," said Kamyar Haghighi, head of the Department of Engineering Education.
Because the information in the document is more than five years old, the College of Engineering worked with the university's registrar's office and alumni association to acquire current addresses. Anyone who does not receive a letter but believes he or she may have been in the affected group can contact Purdue toll-free at (866) 307-8513 to inquire. More information about the incident also is available online at http://www.purdue.edu/news/coe0704.html . At the site, there are links to the Federal Trade Commission, where a complaint about fraud or identity theft can be filed, as well as links to apply for a credit report.
Under university policy, Social Security numbers are no longer used except where required by law. Instead, all students, alumni, faculty and staff, and others whose records are kept for business reasons are assigned a Purdue identification number.
"For decades it was accepted practice to gather and keep on file Social Security numbers because that was the standard means of keeping records on individuals," said Scott Ksander, chief information security officer in the Office of the Vice President for Information Technology at Purdue. "With the need to rely on computers for keeping records of all kinds and the presence of criminals intent on finding ways to access data, we have aggressively moved away from earlier practices in order to safeguard records and identities."
In addition, Purdue also has a large-scale program called SecurePurdue under way to improve security.
Information security staff throughout the Purdue system share best practices and steps for remediation in the event of a break-in. To head off this threat, faculty and staff are instructed to install the latest security programs and to enable automatic updates of security utilities.
A number of steps have been taken to prevent security breaches in recent years. This fall, work began on a system to better detect and prevent intrusion into campus computer networks. The initiative includes expanded availability of anti-spyware software and intensive training for campus systems administrators.
PROTECTING YOUR IDENTITY
The following steps can help guard against identity theft:
* Carefully watch financial statements and credit report statements to check for entries that you do not recognize or any new accounts opened in your name.
* Even if you do not find any suspicious activity on your initial credit reports, the Federal Trade Commission recommends that you check your reports periodically. Identity theft information sometimes is held for use later or is shared among a group of thieves for use at different times.
* Check your credit reports periodically, alternating among the three credit agencies every four months.
* Contact one of the three credit reporting agencies to put a fraud alert on your file. (When you request this from one agency, the other two also will put an alert on your file.) All three credit reporting agencies can be accessed online at http://www.annualcreditreport.com . To request your credit report by phone, call (877) 322-8228; your reports will be mailed to you.
* If you think you have been the victim of fraud or identity theft, contact the Federal Trade Commission to file a complaint at https://rn.ftc.gov/pls/dod/widtpubl$.startup?Z_ORG_CODE=PU03 or call (877) ID-THEFT (438-4338). Your complaint will be added to the FTC's Identity Theft Data Clearinghouse, where it will be accessible by law enforcement agencies for their investigations. The FTC also will advise you on additional steps to take in the event your information is being used illegally.
* Download the FTC's booklet "ID Theft: What's It All About?" at http://www.pueblo.gsa.gov/cic_text/money/idtheftwhat/idtheftwhat.htm . To obtain a copy by mail, or if you have questions or concerns, please contact Purdue's College of Engineering toll-free at (866) 307-8513.
Source: Jeanne Norberg, Purdue spokesperson, (765) 494-2084, email@example.com
Purdue News Service: (765) 494-2096; firstname.lastname@example.org
To the News Service home page