Educational Security Incidents (ESI)

Quick Facts

• Date: 9/26/2007
• Institution: Temple University
• Type of Incident: Unauthorized Disclosure
• Number Affected: 90
• Source: ESI
• Abstract Source: SSNBreach.org

Abstract
Aaron Titus, from SSNBreach.org, wrote to ESI about two files found on a web site belonging to Temple University. These files, found on university's Computer Information System site, contained names, partial social security numbers, grades, passwords and other sensitive information on 90 university students. The university removed these files a few hours after being alerted and has also requested the files be removed from search engine caches. According to Temple Privacy Officer Robert Edamala the university has requested full audits of all systems and will require all Computer Information System faculty and staff attend Information Security and Privacy training.

Quick Facts

• Date: 9/26/2007
• Institution: Southern Oregon University
• Type of Incident: Loss
• Number Affected: 400
• Source: Pogo Was Right
• Abstract Source: Mail Tribune

Abstract
Southern Oregon University is alerting roughly 400 students that a list containing personal information was misplaced recently by a university worker. The list, used to prepare rooms for incoming students in two of the university's residence halls, contained names, phone numbers, addresses, room numbers, genders, birth dates and university student identification numbers. While there is no immediate threat to students, the university has sent out notifications. In addition, the university will change this list so that in the future it simply contains only the necessary information, names and room numbers.

Quick Facts

• Date: 9/22/2007
• Institution: Plymouth State University
• Type of Incident: Penetration
• Number Affected: None
• Source: Pogo Was Right
• Abstract Source: Citizen Online

Abstract
Plymouth State University recently discovered that an unknown individual(s) had gained unauthorized access to the university web server over one year ago. Server logs indicated that a malicious piece of software was uploaded to the web server and web site content was altered to direct visitors to an web site promoting the sale of software. According to university officials, no personal or sensitive information was compromised during this incident. The university plans to institute a new policy monitoring policy to ensure that no future unauthorized activity occurs.

Quick Facts

• Date: 9/21/2007
• Institution: Central Piedmont Community College
• Type of Incident: Penetration
• Number Affected: 2,600
• Source: Pogo Was Right
• Abstract Source: News 14 Carolina

Abstract
Officials at Central Piedmont Community College are alerting all 2,800 staff members as a precaution after evidence of a possible security breach by a former CPCC employee. The former employee in question may have gained access to current employee information including names, Social Security numbers and addresses. CPCC is urging all employees monitor their credit reports and mailed employees information on how to obtain free credit reports. According to John Cone, a CPCC employee, "We exchange information so readily and across so many streams of the net. This can happen anytime, anywhere, it’s no longer an unusual issue." CPCC is currently working with the local police force to investigate this incident.

Quick Facts

• Date: 9/20/2007
• Institution: University of Kansas
• Type of Incident: Unauthorized Disclosure
• Number Affected: Hundreds
• Source: ESI
• Abstract Source: 49 News, ABC

Abstract
The University of Kansas is apologizing to students and plans to launch an investigation to determine how files containing personal information on hundreds of students ended up in the trash. The files, obtained by the media along with an anonymous letter stating the files were pulled from the trains, contained names, copies of Social Security cards, final exams, and transcript release forms. According to Lynn Bretz, Director of University Communications, "We're launching a major initiative, the provost announced it several weeks ago, an information management initiative that's going to review our current guidelines."