September 10, 2007

Purdue tells 111 of possible computer security incident

The information was in a document that contained the names and Social Security numbers for students in the Animal Sciences 102 class. The page was no longer in use but was on a computer server connected to the Internet. The document was found recently through an internal search and reported to Purdue's chief information security officer.

The page has been removed, and letters mailed to those potentially affected.

"We do not know that anyone has used this information illegally, but because the possibility exists, we are trying to inform every person whose information was in the file," said Alan Grant, professor and head of the Department of Animal Sciences.

Because that class is typically taken by freshmen, many of the students affected are still located at Purdue, he said.

Anyone who does not receive a letter but believes he or she was in the class may contact Purdue toll-free at (866) 275-1181 to inquire. More information also is available online at https://www.purdue.edu/news/coa0709.html. At the site, there are links to the Federal Trade Commission, where a complaint about fraud or identity theft can be filed, as well as links to apply for a credit report.

Under university policy, Social Security numbers are no longer used except where required by law. Instead, all students, alumni, faculty and staff, and others whose records are kept for business reasons are assigned a Purdue identification number.

"For decades it was accepted practice to gather and keep on file Social Security numbers because that was the standard means of keeping records on individuals," said Scott Ksander, chief information officer in the Office of the Vice President for Information Technology at Purdue. "With the need to rely on computers for keeping records of all kinds and the presence of criminals intent on finding ways to access data, we have aggressively moved away from earlier practices in order to safeguard records and identities."

In addition, Purdue also has a large-scale program called SecurePurdue under way to improve security.

Information security staff throughout the Purdue system share best practices and steps for remediation in the event of a break-in. To head off this threat, faculty and staff are instructed to install the latest security programs and to enable automatic updates of security utilities.

A number of steps have been taken to prevent security breaches in recent years. Last fall, work began on a system to better detect and prevent intrusion into campus computer networks. The initiative includes expanded availability of anti-spyware software and intensive training for campus systems administrators.

PROTECTING YOUR IDENTITY

The following steps can help guard against identity theft:

* Carefully watch financial statements and credit report statements to check for entries that you do not recognize or any new accounts opened in your name.

* Even if you do not find any suspicious activity on your initial credit reports, the Federal Trade Commission recommends that you check your reports periodically. Identity theft information sometimes is held for use later or is shared among a group of thieves for use at different times.

* Check your credit reports periodically, alternating among the three credit agencies every four months.

* Contact one of the three credit reporting agencies to put a fraud alert on your file. (When you request this from one agency, the other two also will put an alert on your file.) All three credit reporting agencies can be accessed online at https://www.annualcreditreport.com. To request your credit report by phone, call (877) 322-8228; your reports will be mailed to you.

* If you think you have been the victim of fraud or identity theft, contact the Federal Trade Commission to file a complaint at https://www.annualcreditreport.com or at 1-877- ID-THEFT (438-4338). Your complaint will be added to the FTC's Identity Theft Data Clearinghouse, where it will be accessible by law enforcement agencies for their investigations. The FTC also will advise you on additional steps to take in the event your information is being used illegally.

* Information about how to protect your identity and prevent identity loss is available from Purdue at https://www.purdue.edu/securePurdue/theft.cfm and the Federal Information Center's consumer action at https://www.consumeraction.gov/caw_identity_preventing.shtml.

Source: Jeanne Norberg, Purdue spokesperson, (765) 494-2084, jnorberg@purdue.edu

Purdue News Service: (765) 494-2096; purduenews@purdue.edu

To the News Service home page