Educational Security Incidents (ESI)

Quick Facts

• Date: 7/24/08
• Institution: Hillsborough Community College
• Type of Incident: Theft
• Number Affected: 2,000
• Source: Pogo Was Right
• Abstract Source: Tampa Bay Online

Abstract
Hillsborough Community College is warning 2,000 staff members to monitor their bank accounts after the theft of a laptop containing staff information from a hotel parking lot. The laptop was used in as part of payroll project that involved names, Social Security numbers, bank-routing numbers and retirement information. According to the college spokesperson Ashley Carl, the programmer had deleted the information from the password-protected laptop prior to the theft. In the e-mail sent to staff, HCC vice president of information technology R. Bruce Judd asked that the affected individuals monitor their bank accounts and alert their banks and the college about any suspicious activity.

Quick Facts

• Date: 7/24/08
• Institution: Hillsborough Community College
• Type of Incident: Theft
• Number Affected: 2,000
• Source: Pogo Was Right
• Abstract Source: Tampa Bay Online

Abstract
Hillsborough Community College is warning 2,000 staff members to monitor their bank accounts after the theft of a laptop containing staff information from a hotel parking lot. The laptop was used in as part of payroll project that involved names, Social Security numbers, bank-routing numbers and retirement information. According to the college spokesperson Ashley Carl, the programmer had deleted the information from the password-protected laptop prior to the theft. In the e-mail sent to staff, HCC vice president of information technology R. Bruce Judd asked that the affected individuals monitor their bank accounts and alert their banks and the college about any suspicious activity.

Quick Facts

• Date: 7/15/2008
• Institution: Indiana State University
• Type of Incident: Theft
• Number Exposed: 2,500
• Source: ESI
• Abstract Source: The Tribune-Star
• Update1 Source: WLFI

Abstract
Indiana State University is working to alert more then 2,500 current and former students about the theft of a laptop containing student information. The laptop, stolen from an economics professor while traveling in southern Indiana, contained students names, grades, e-mail addresses, student ID numbers (after 2003) and Social Security numbers (up to 2003) for students that had taken economics classes between 1997 and spring semester 2008. According to the university, there is no evidence of any identity theft but the university urges affected students to place fraud alerts on their credit reports.

Update1
Indiana State University officials announced that the stolen laptop has been returned to the professor six days after it was stolen. The laptop was mailed back to the university by an anonymous individual along with several other personal items that were taken. According to ISU spokesman Dave Taylor, the password-protected computer showed that none of its data had been accessed. However, the university is still notifying students as a precaution.

Quick Facts

• Date: 6/25/2008
• Institution: Cornell University
• Type of Incident: Theft
• Number Affected: 2,500
• Source: ESI
• Abstract Source: The Ithaca Journal

Abstract
Cornell University recently announced that it will begin offering one year of free credit protection to 2,500 students whose personal information may have been copied from a desktop computer. The possible breach was discovered in March, when Cornell staff found a computer in the Office of Minority Educational Affairs was infected with several viruses and malware that could have been used to record and steal information on the computer. One of the files on this affected computer contained a spreadsheet with names and Social Security numbers of a large number students and alumni that had participated in the University's Pre-Freshman Summer Program.

Quick Facts

• Date: 6/10/2008
• Institution: University of Utah
• Type of Incident: Theft
• Number Affected: 1,500,000 (Revised)
• Source: ESIhttp://www.adamdodge.com/esi/node/352/edit
• Abstract Source: University Health Care News Release
• Update1 Source: The Salt Lake Tribune
• Update2 Source: The Salt Lake Tribune

Abstract
The University of Utah Hospitals & Clinics is currently notifying 2.2 million patients about the theft of medical billing records. On June 2, a box of backup tapes containing patient and guarantors billing records was stolen out of a car belonging to a contracted independent storage company. The tapes contained the personal information on 2.2 million patients and guarantors including patient names, related demographic information and diagnostic codes. In addition, these records contained the Social Security numbers of 1.3 million patients. The Salt Lake County Sheriff’s Department, the FBI and the U.S. Postal Service are investigating the theft. According to Lorris Betz, M.D., Ph.D, Senior Vice President for Health Sciences, University of Utah Hospitals & Clinics is taking aggressive steps to protect patient confidentiality including notifying all 2.2 million individual through postal mail, offering one year of free credit monitoring to those whose SSNs were on the tapes and offering a $1,000 reward for the return of the tapes, no questions asked. The University of Utah Hospitals & Clinics has also setup a hotline - 866-581-3599 - and a web site - healthcare.utah.edu/billingrecordstheft - to help answer any questions and provide more information about the theft.

Update1
The University of Utah Hospitals & Clinics has revised the total number of affected individuals to 1.5 million. The revised count takes into account duplicate records and records on deceased individuals. However, the university also removed individuals where there is no valid address for the record. A spokesperson encouraged anyone who is concerned that they might be affected to call the hotline setup by University of Utah Hospitals and Clinics, especially if they do not receive a notification letter by July 1.

Update2
The stolen backup tapes containing 1.5 million University of Utah Hospital and Clinics patient records have been recovered according to the Salt Lake County Sheriff's Office. Detail surrounding the recovery are not available at this time but no arrests have been made concerning the theft. Salt Lake County sheriff's Lt. Paul Jaroscak called the investigation in to the theft deep and ongoing.