Educational Security Incidents (ESI)

Quick Facts

• Date: 5/27/2008
• Institution: Oklahoma State University, Stillwater
• Type of Incident: Unauthorized Disclosure
• Number Affected: 3
• Source: SSNBreach.org
• Abstract Source: SSNBreach.org Media Release

Abstract
The Liberty Coalition recently notified Oklahoma State University, Stillwater that student information was available through a university web site. The web site, which belonged to the university's Vietnamese American Student Association (VASA), contained an excel file with the campus addresses, names and Social Security numbers of three students. This file had been online for six years and the students affected had received reimbursement for expenses related to a VASA tournament held in March 2002.

Quick Facts

• Date: 5/15/2008
• Institution: Oklahoma State University - Stillwater
• Type of Incident: Penetration
• Number Affected: 70,000
• Source: ESI
• Abstract Source: The Daily O'Collegian, OSU - Stillwater Incident Alert
• Update1 Source: The Oklahoman

Abstract
Oklahoma State University - Stillwater is alerting staff and faculty that a parking server containing personal information was recently breached by an unknown individual(s). The server, used by the University's parking and transit services, housed a database containing the names, addresses, phone numbers, e-mail addresses and Social Security numbers on an unknown number of faculty and staff. After investigating the breach, OSU - Stillwater believes the attacker(s) breached the server for bandwidth and storage space, not the information housed on the system. However, OSU - Stillwater officials are working to notify any faculty or staff member that had purchased a parking permit between July 2002 and March 2008 just to be safe. President Burns Hargis called the security incident "totally unacceptable" and apologized for the incident. OSU - Stillwater has setup a website - idalert.okstate.edu/incident_00003.html - with more information.

Update1
The recent breach at Oklahoma State University affected a total of 70,000 students, faculty and staff. The university discovered the server breach back in March but waited until May to begin notifying individuals. According to officials the delay was due to an investigation to determine if the Social Security numbers had been accessed. The university was not able to make a determination. The affected server has been taken offline and the Social Security numbers have been removed.