Educational Security Incidents (ESI)

Quick Facts

• Date: 11/6/2008
• Institution: Harvard Law School
• Type of Incident: Loss
• Number Affected: 21,000
• Source: Data Loss Database
• Abstract Source: The Boston Globe

Abstract
Harvard Law School is alerting clients of its Jamaica Plains center that a backup tape containing client data was lost. The tape contained 21,000 client records including 8,000 records with Social Security numbers. According to law school officials the data on the tape was protected by a password and username, but it was not encrypted. The tape was lost while a staff member was carrying six tapes to the Cambridge office. The tape is not labeled in any way that would indicate its content. Harvard Law School is implementing plans to encrypt all computer servers and backup tapes.

Quick Facts

• Date: 9/30/2008
• Institution: University of Indianapolis
• Type of Incident: Penetration
• Number Affected: 11,000
• Source: Attrition.org
• Abstract Source: Chicago Tribune

Abstract
The University of Indianapolis has begun notifying students, faculty and staff after an unknown individual breached a computer system containing personal information. The computer system affected contained records dating back more then two years that contained the names and Social Security numbers on 11,000 students, faculty and staff. U. Indy became aware of the breach after another school notified the university. The university is working with outside consultants to investigate the incident. According to University of Indianapolis president Beverley J. Pitts, "Our investigation leaves no doubt that this was a professional job by hackers from outside, and it was well beyond our control". U. Indy is offering affected individuals one year of free credit monitoring.

Quick Facts

• Date: 8/30/2008
• Institution: Rochester Institute of Technology - National Technical Institute for the Deaf
• Type of Incident: Theft
• Number Affected: 13,800
• Source: Attrition.org
• Abstract Source: WHAM

Abstract
Rochester Institute of Technology began notifying individuals associated with the National Technical Institute for the Deaf after a laptop containing personal information was discovered missing on August 25. According to RIT officials, the laptop contained the names, birth dates and Social Security numbers of the 12,700 individuals that had enrolled in the NTID since 1968. In addition, 1,100 members of the RIT community are affected by the theft as well. RIT officials are working with the Monroe County Sheriff's Department and urge affected individuals to place fraud alerts on their credit files. RIT has setup a hotline - 866-624-8330 - and web site - www.rit.edu/news/?v=46283 - to help answer additional questions about the theft.

Quick Facts

• Date: 7/25/08
• Institution: Ohio University
• Type of Incident: Unauthorized Disclosure
• Number Affected: 492
• Source: Attrition.org
• Abstract Source: The Columbia Dispatch

Abstract
A clerical error at Ohio University's Centers for Osteopathic Research and Education (CORE) caused personal information on 492 individuals to be posted online. The data, contained in an excel spreadsheet, contained the names, Social Security numbers, addresses, contact numbers and federal employment identification numbers of individuals that had spoke at CORE according to a university spokesperson. The spreadsheet had been available from March 20 until it was removed on June 16 when a nurse discovered the file while doing research online. According to CORE the document that should have been posted did not contain any personal information. The individual that made the error was placed on paid administrative leave pending a review. CORE has created a web site - www.ohiocore.org/answers - and hotline - 866-437-8698 - to help answer questions.

Quick Facts

• Date: 6/6/2008
• Institution: Stanford University
• Type of Incident: Theft
• Number Affected: 72,000
• Source: Attrition.org
• Abstract Source: Stanford News Service

Abstract
Standford University is working to alert current and former employees after the university determined a stolen laptop contained confidential employee information. The university is currently investigating the incident and has not released any details about the theft. According to the university officials the laptop may contain the names, Social Security numbers, salary information, Stanford IDs, dates of birth, gender information, home addresses, telephone numbers and Stanford e-mail addresses on as many as 72,000 individuals. This incident affects those employees that had received a paycheck from the university before September 28, 2007.