Educational Security Incidents (ESI)

Quick Facts

• Date: 8/26/2006
• Institution: University of South Carolina
• Type of Incident: Penetration
• Number Affected: 6,000
• Source: Attrition.org
• Abstract Source: The State (via Attrition mirror)

Abstract
The University of South Carolina recently warned 6,000 students that their personal information is a risk due to a computer breach. A recent computer security audit reveled that an unknown individual gained unauthorized access to a computer server back in September 2005. This server contained student information including names and Social Security numbers. The university is not aware of any illegal use of this information but expresses regret over the incident. According to officials the incident should have occurred and USC has secured the server.

Quick Facts

• Date: 8/25/2006
• Institution: University of Iowa
• Type of Incident: Unauthorized Disclosure
• Number Affected: Unknown
• Source: InfoSec News
• Abstract Source: The Des Moines Register

Abstract
A recent audit of wireless connectivity at the University of Iowa uncovered 80 rouge access points (APs) throughout nine academic buildings. Over half of these APs had no encryption or security features enabled, leaving both the U of I network and student information vulnerable to attack. It is believed that impatience caused faculty and staff installed these wireless access points. Current wireless access only covers about 15% of the U of I campus. The University of Iowa is currently working on pinpointing these rouge access points and converting these APs either to authorized access points (with security features enabled) or back to wired connections. U of I is also working towards expanding its overall wireless coverage.

Quick Facts

• Date: 08/15/2006
• Institution: University of Kentucky
• Type of Incident: Unauthorized disclosure
• Number Affected: 710
• Source: Attrition.org
• Abstract Source: WKYT Kentucky (Attrition.org Archive)

Abstract

Student information, including Social Security numbers, was accidentally posted to a University of Kentucky e-mail list. This information, a list of 630 students receiving financial aid information, continued student names and SSNs, which UK still uses as student ID numbers. UK has a plan in place already to stop using Social Security numbers in October of this year. Jay Blanton, a PR specialist for the University, calls the mistake regrettable and says students have been notified.

On this same day, UK discovered an incident at the University's Department of Geography that involved personal information on 80 students.

Quick Facts

• Date: 08/02/2006
• Institution: Belhaven College
• Type of Incident: Theft
• Number Affected: Up to 300
• Source: Attrition.org
• Abstract Source: The Clarion Ledger

Abstract

A Belhaven College employee was approached from behind in a Belhaven parking lot and robbed of their wallet and a laptop computer which contained Social Security numbers, names and bank account information on a number of Belhaven employees. While the College is not aware of how many employees are affected, Belhaven issued a memo to all employees warning of the possibility of Identity Theft. According to Belhaven College President Roger Parrott, there have been no reported ID thefts related to this theft and the memo was sent out as a precaution. In this memo Parrott suggests that employees contact one of the three major credit bureaus and alert them to the possibility of Identity Theft.

Quick Facts

• Date: 08/01/2006
• Institution: California Polytechnic State University
• Type of Incident: Theft
• Number Affected: 3,020
• Source: Attrition.org
• Abstract Source: San Luis Obispo Tribune

Abstract

A laptop stolen from the home of Cal Poly professor John Mottman contained the Social Security numbers on any student that took Mottman's astronomy or physics lectures between 1994 and 2004. During this period, Cal Poly used Social Security numbers on class lists as unique identifiers. This practice ended in 2004. In fact, Cal Poly is attempting to change its practice of using Social Security numbers altogether. Cal Poly is recommending that any affected student contact one of the three major credit bureaus and request a fraud alert be placed on their credit report.