Educational Security Incidents (ESI)

Quick Facts

• Date: 7/26/2007
• Institution: University of Glamorgan
• Type of Incident: Impersonation
• Number Affected: At least 2
• Source: ESI
• Abstract Source: icWales

Abstract
University of Galmorgan identity theft lecturer Eni Oyegoke has been sentenced after pleaded guilty to 13 fraud, deception and theft offences. Oyegoke began at Glamorgan as a PhD student in 2005, a position he gained using a false passport. Soon after, Oyegoke began lecturing students on the topic of identity theft, a topic he apparently was very familiar with. Authorities were first made aware of the problem when Oyegoke applied for a drivers license using his fake passport information. During a raid on his house, authorities found credit cards Oyegoke had opened under other identities and a fake drivers license. Oyegoke used the two credit cards to help pay for his tuition and the fake drivers license was part of his doctoral thesis according to his lawyer. Oyegoke faces a two year jail sentence and will be deported after serving his time.

Quick Facts

• Date: 7/26/2007
• Institution: Penn State University
• Type of Incident: Unauthorized Disclosure
• Number Affected: 10,554
• Source: Pogo Was Right
• Abstract Source: Marine Times

Abstract
A Marine looking for his own name on Google came across more then he expected. Personal information on 10,554 Marines was available for a 10-11 day period on a Penn State web site. The site contained information on Marines who had rifle range requalification records while attending Marine Corps Recruit Depot Parris Island, S.C., from January 2004 through December 2006 and was collected by Penn State as part of a research program. Information collected by Penn State included names and Social Security numbers. According to Penn State officials, logs indicate that the information was only accessed once by the individual Marine that reported the incident. The information was pulled from the site as soon as Penn State was aware of the problem.

Quick Facts

• Date: 7/25/2007
• Institution: Nottingham University Hospitals
• Type of Incident: Theft
• Number Affected: 1
• Source: ESI
• Abstract Source: E-Health Insider

Abstract
A thief made off with a USB thumb drive belonging to a Nottingham University Hospitals junior doctor that contained sensitive patient medical information. After reviewing the incident, it looks like using USB drives to store patient information is a common practice among Nottingham University Hospitals junior doctors. During research for the British Medical Journal, Matthew Daunt a foundation year one doctor, recently questioned 50 junior doctors about storing patient data. Of the 20 doctors that admitted to using USB drives to store data, not one of them used encrypted USB drives, leaving patient data readable to anyone with a computer and the drive itself. Since this incident, the Nottingham University Hospitals trust plans to being offering 128-bit encrypted USB drives to all junior doctors.

Quick Facts

• Date: 7/21/2007
• Institution: University of Michigan
• Type of Incident: Penetration
• Number Affected: 5,500
• Source: Attrition.org
• Abstract Source: Detroit Free Press

Abstract
The University of Michigan is alerting current and former students about the exposure of personal information after an unknown individual(s) gained access to two School of Education databases. These databases contained the names, addresses, and some Social Security numbers of 5,500 individuals. At this point there is no evidence that the individual(s) that gained access were after personal information, but the university's public safety department is investigating the incident. The breach was first discovered on July 3 and the university began sending out notifications on July 16. According to Kelly Cunningham, a university spokesperson, the notifications were sent out as a precaution.

Quick Facts

• Date: 7/18/2007
• Institution: Purdue University
• Type of Incident: Unauthorized Disclosure
• Number Affected: 50
• Source: Pogo Was Right
• Abstract Source: Inside Indiana Business

Abstract
Purdue University is apologizing to students after it discovered a web page containing student information was available on the Internet. This page, containing the names and Social Security numbers of 50 students, was discovered during a routine review of the Purdue web space. The individuals affected by this incident involve those students enrolled in the university's industrial engineering 500-level course between spring 2002 and fall 2004. Purdue has already mailed out letters to those affected students, but has setup a hotline - 866-605-0013 - and a web site - www.purdue.edu/news/coe0706.html - to help answer any questions students have about the incident.