March 24, 2005

Purdue issues alert about illegal access of computers

WEST LAFAYETTE, Ind. – Purdue University is alerting more than 1,200 faculty, staff, students, alumni and business affiliates that some of their personal information may have been illegally accessed from one of three computer workstations.

On Jan. 27, Purdue staff discovered that an unknown person or group had accessed a computer in the College of Liberal Arts' Theatre Division, said Joseph L. Bennett, vice president for university relations. Because of the January incident, liberal arts technology staff subsequently conducted additional scans and found a similar problem on two other computers in the history and health and kinesiology departments.

Information technology staff reviewed files from the computers to determine what kind of information could have been accessed. The computers contained information, such as names and Social Security numbers. The computer in the Theatre Division contained personal information for 1,128 people, while the computers in the history and health and kinesiology departments housed information on 37 and 101 people, respectively.

"While this information was vulnerable, we cannot say with certainty whether it actually was accessed," Bennett said. "We take this very seriously because files on these computers contained information that could be used to commit identity theft. Unfortunately, technologies that allow us to obtain and process information so easily can be misused by those with dishonest motives. Unauthorized access to computers is a global problem that concerns every business and organization."

All three groups will be notified by letter of the incident. The letter was sent on Wednesday (March 23).

The letter includes Federal Trade Commission recommendations that those at risk monitor credit cards and banking statements, as well as to report any unusual financial activity to Purdue police.

Bennett said people also should be cautious if contacted by individuals saying they are affiliated with Purdue and who offer to help or are requesting private information.

"No Purdue representatives will be calling or e-mailing to ask for anyone's personal information," Bennett said.

Staff at Purdue's security and privacy division at Information Technology at Purdue (ITaP) performed a routine scan on Jan. 27 and were alerted that a computer in theater was possibly compromised with a root kit, a piece of software that is built to take over a machine by hiding services, ports and files from the actual operating system. The incident was confirmed, and the machine was taken offline within an hour. The other two machines were compromised using similar software, Bennett said.

Since then, information technology staff in the College of Liberal Arts have been involved in the time-consuming task of manually sorting through computer files to identify individuals whose personal information was stored on the machines.

All three machines were probably breached sometime in November. Bennett said there was no evidence linking this incident with an October report of unauthorized users gaining access to several university computer systems. In that case, a number of computer passwords were obtained, and all university computer system users were required to change their passwords.

Bennett said a letter also was sent to all liberal arts faculty and staff to remind them about university policy on secure storage and use of personal information, especially Social Security numbers, on computers. ITaP has created an informational Web site that addresses the incident, as well as measures users can take to protect themselves from identity theft and a frequently-asked-questions section.

"Liberal arts has taken additional steps to strengthen computer security, improve staff training and work to assure that all sensitive information is stored on machines that have appropriate security levels," he said.

Writer: Amy Patterson-Neubert, (765) 494-9723, apatterson@purdue.edu

Source: Joseph L. Bennett, (765) 494-2082, jbennett@purdue.edu

Purdue News Service: (765) 494-2096; purduenews@purdue.edu

To the News Service home page