Adam On…

Update2: Ruth Shuman, Dean for Institutional Advancement at Lasell College, contacted me to let me know that Lasell College has established a call center with First Advantage Corporation where affected individuals can sign up for six months of free credit monitoring.

Update: I was contacted by Lasell College about this incident (see comment below). While I generally do not take kindly to threats, I am always willing to admit a mistake when I make one. It seems that Lasell College is offering free credit monitoring to the individuals affected by this incident. I am waiting to hear back from Lasell College to see if I can link to information about what is being offered to the students.

My apologies to anyone that thought this post was directly aimed at Lasell College’s handling of this incident. The goal was instead to point out to the many educational institutions that do not offer free credit monitoring that they are missing a great opportunity for good PR with the affected individuals.

Original Story: Earlier this month, Lasell College alerted 20,000 current and former students, faculty and staff that an employee illegally gained access to a database containing personal information such as names, Social Security numbers and addresses. In response to this incident, the college contacted law enforcement, sent out letters, and setup a web site and hotline to help answer questions. All of these steps are exactly what colleges and universities should do in the event of a security breach.

However, one move that Lasell, like many educational institutions, did not take was to offer free credit monitoring for the affected individuals. This is a move that continues to amaze me. Given the increasing rates of Identity Theft and the publics awareness of the threats, offering free monitoring just makes sense. (Please note that I don’t necessarily agree with the rise in “Identity Theft” given that to me Credit Card fraud does not equal ID Theft. Nor do I agree that credit monitoring is the ultimate solution, but more on these two topics to come.)

If nothing else, the offer of credit monitoring (opt-in of course) is a good way to gain some valuable PR when announcing a breach. Sure, your students/staff/faculty/alumni/donors might be miffed over the loss of their personal information, but what better way to soften the blow then with a years worth of free monitoring to show the college or university really does care about them?

Question the PR value of this? Think again. In the case of Lasell, IdentityTruth, a credit monitoring service, saw an opportunity for good PR and jumped on it. IdentityTruth decided to reach out to the individuals affected by the Lasell incident and offer them the first month of protection for only $1. For those keeping score, $1 is about a 90% discount. Of course IdentityTruth is most likely banking on the individuals remaining with the service after the discount period ends and the cost goes up to $9.99.

I am not saying that people should run to a credit monitoring service like IdentityTruth. Also, I am not saying that I believe services like IdentityTruth have value. Personally, I know nothing about IdentityTruth and thus am in no place to judge the quality or value of the service.

What I am saying is that IdentityTruth gained valuable PR (hey I’m talking about them aren’t I) while Lasell College now, at least to me, is in a position where it looks like a company not even connected with the college cares more about the protection of these individuals’ identities then the college does. Alright, that might be pushing it a little, but the point remains. If your institution is affected by a breach who would you rather see offering to protect you through credit monitoring your institution or some third-party company?

At the very least Lasell College could have gained some good PR by contacting a credit monitoring company and working out a deal where the college is charged a reduced rate based on the potential of signing up 20,000 accounts. The press release could then have at least read “IdentityTheft and Lasell College Reach Out To Alumni, Students and Faculty” instead of “IdentityTheft Reaches Out to Lasell College Alumni, Students and Faculty”.

Amazing how much can change just by moving a few simple words.