Educational Security Incidents (ESI)

Quick Facts

• Date: 6/23/2009
• Institution: Cornell University
• Type of Incident: Theft
• Number Affected: 45, 277
• Source: ESI
• Abstract Source: WVBR

Abstract
Cornell University is working to notify current and former students and staff after the theft of a laptop containing personal information. The laptop, which was being used to help diagnose transmission problems with the university's central administrative systems and does not appear that have been encrypted, contained the names and Social Security numbers of 22,546 current and former students and 22,731 current and former faculty and staff members. The laptop was stolen earlier this month but university officials did not learn of the theft until late last week. Cornell officials have sent an email notification to all affected individuals and will be sending out letters shortly. Cornell has setup a FAQ to help answer questions people may have about this theft.

Special thanks to David DyTang for making us aware of this incident. - Adam

Quick Facts

• Date: 6/17/09
• Institution: Johns Hopkins University - Applied Physics Laboratory
• Type of Incident: Penetration
• Number Affected: N/A
• Source: ESI
• Abstract Source: The Baltimore Sun

Abstract
The Web site for the Johns Hopkins University's Applied Physics Laboratory (APL) has been taken off line as staff investigate a cyber attack discovered Sunday. The APL, which performs research on military and NASA projects, found that an unknown individual penetrated the Web site and gained access to unclassified information. According to APL officials, the attacker(s) did not gain access to any internal systems or classified information. While the investigation is still ongoing, it appears that the attack may have started two weeks ago. An APL spokesperson said that while the web site has had minor security breaches in the past, this recent attack has been one of the most significant to date.

Quick Facts

• Date: 6/17/09
• Institution: University of North Dakota
• Type of Incident: Theft
• Number Affected: 84,000
• Source: ESI
• Abstract Source: Post and Courier

Abstract
A laptop containing University of North Dakota donor information was recently stolen from the car of a contractor. The laptop, belonging to an employee of Blackbaud, Inc., contained information on 84,000 individuals. Blackbaud was hired to develop software for the university's foundation and alumni association. According to Blackbaud officials, the information on the laptop was encrypted and the theft was reported to the two university groups immediately. The company is working with the university groups to notify the affected individuals and help them monitor their credit reports. Blackbaud is also looking into why the employee had the information on the laptop top for a longer time period then they should have.

Updated 6/18 - Corrected typo in the title. Thanks to Allison Dolan for letting us know. - Adam

Quick Facts

• Date: 6/12/2009
• Institution: Kirkwood Community College
• Type of Incident: Theft
• Number Affected: 1,600
• Source: DataBreaches.net
• Abstract Source: TMCNet

Abstract
Kirkwood Community College (KCC) is working to notify individuals and businesses after the theft of a mobile storage device. The device, stolen on June 4th from the college's Skills to Employment office, contained the names and Social Security numbers of individuals and business contact information of participant program employers of the federally funded PROMISE JOBS program. The device was returned shortly after KCC staff notified authorities of the theft. However, computer experts examining the device were not able to assure the data had not been accessed.

Quick Facts

• Date: 6/12/09
• Institution: Oregon Health & Science University
• Type of Incident: Theft
• Number Affected: 1,000
• Source: DataBreaches.net
• Abstract Source: KPTV

Abstract
Oregon Health & Science University (OHSU) is working to contact patients after a laptop containing patient information was stolen. The laptop, stolen from a physician's car, contained the names, treatment dates, treatment summaries and medical record numbers on about 1,000 patients. According to OHSU officials the laptop was password protected to avoid misuse of the data.