Educational Security Incidents (ESI)

Quick Facts

• Date: 11/6/2008
• Institution: Harvard Law School
• Type of Incident: Loss
• Number Affected: 21,000
• Source: Data Loss Database
• Abstract Source: The Boston Globe

Abstract
Harvard Law School is alerting clients of its Jamaica Plains center that a backup tape containing client data was lost. The tape contained 21,000 client records including 8,000 records with Social Security numbers. According to law school officials the data on the tape was protected by a password and username, but it was not encrypted. The tape was lost while a staff member was carrying six tapes to the Cambridge office. The tape is not labeled in any way that would indicate its content. Harvard Law School is implementing plans to encrypt all computer servers and backup tapes.

Quick Facts

• Date: 9/12/2008
• Institution: Tennessee State University
• Type of Incident: Loss
• Number Affected: 9,000
• Source: ESI
• Abstract Source: Nashville Post
• Update1 Source: News Channel 5

Abstract
Tennessee State University recently announced that a flash drive containing student financial information has turned up missing. The drive, containing the names, Social Security numbers and financial records of over 9,000 TSU students dating back to 2002, was last seen Monday. TSU plans to have contacted all affected individuals by Friday of next week. TSU is offering one year of credit monitoring to all affected students. According to university officials, it appears the information was neither encrypted nor password-protected which is against university policies. The TSU Department of Internal Audit has launched an investigation into this incident and the employee that lost the flash drive has been placed on paid leave pending the outcome of the investigation.

Update1
According to a statement by TSU President Melvin Johnson the university has recovered the flash drive. Apparently the flash drive was taken by a student from the forum and used to save a paper. While the university does not believe the financial information was accessed, an audit is being conducted by the state to verify the data was not copied or tampered with.

Quick Facts

• Date: 8/4/2008
• Institution: Arapahoe Community College
• Type of Incident: Loss
• Number Affected: 15,000
• Source: Pogo Was Right
• Abstract Source: 9News

Abstract
Arapahoe Community College has issued alerts to students after it discovered that a flash drive containing student information has been lost or possibly stolen. The drive contain the names, address, Social Security numbers and credit card numbers on 15,000 students. The records on the drive came from the college's Corporate Learning Division and some of them dated back to 1997. Arapahoe is urging affected individuals to place a fraud alert on their credit reports. Anyone with questions is asked to contact the college at 303-797-5091. (Note: An individual claiming to be from Arapahoe Community College left a message on the news story stating that "out of the 15,000 records at risk - only 5,286 contained credit card or social security information. Only 1,200 students received customized training from this division a year and the only reason 15,000 records were in the database is because it was a compilation of 11 years." See the Abstract Source link above for full story and comment.)

Update1
Note that this information was lost or stolen from a contractor and not an Arapahoe Community College employee. The student information was contained on a flash drive that went missing while the contractor was at the Copper Mountain Resort. Special thank you to Allison Dolan for make ESI aware that this information was missing from the original abstract.

Quick Facts

• Date: 5/30/2008
• Institution: New Hampshire Technical Institute
• Type of Incident: Loss
• Number Affected: 128
• Source: Pogo Was Right
• Abstract Source: New Hampshire Attorney General Office [pdf]

Abstract
The New Hampshire Technical Institute is working to alert former nursing program students after a USB flash drive was discovered missing. NHTI launched an investigation into the missing flash drive and was unable to determine whether or not the drive contained student information. According to the letter to the New Hampshire Attorney General, the missing drive may contain the names, addresses, phone numbers, e-mail addresses, and Social Security numbers of 128 nursing program graduates from the classes of 2006 and 2007. NHTI is offering 12 months of free credit monitoring to the affected students.

Quick Facts

• Date: 1/31/2008
• Institution: University of Minnesota
• Type of Incident: Loss
• Number Affected: 3,100
• Source: ESI
• Abstract Source: WCCO

Abstract
University of Minnesota's Reproductive Medicine Center is alerting patients after it became aware of the loss of a USB drive containing patient information. The drive belonged to Dr. Theodore Nagel which he used to store unencrypted and unprotected backups of his computer, which is against U of M regulations. The drive contained the names and infertility treatments of 3,1000 of Nagel's patients dating back to 1999. Nagel reported the loss to the center and has personally written letters of apology to the affected patients.