Educational Security Incidents (ESI)

Quick Facts

• Date: 7/2/2008
• Institution: University of Nebraska at Kearney
• Type of Incident: Penetration
• Number Affected: 2,035
• Source: ESI
• Abstract Source: NTV

Abstract
The University of Nebraska at Kearney has begun sending letters to former students after nine computers where discovered to have been compromised by an unknown individual. These computers, located in the College of Natural and Social Sciences contained information on advisees in the Department of History in 2002 and 2003, deciding students in Fall 2001 and Fall 2002, and students in the online Master of Science in Biology program since Spring 2005 including 2,035 student Social Security numbers. According to university officials, no academic records were affected. The university has created a web site - www.unk.edu/securityincident/ - and a hotline - 308-865-8950 - where concerned individuals can get more information. On the web site, the university recommends that students affected by this incident place fraud alerts on their credit reports.

Quick Facts

• Date: 6/3/2008
• Institution: Oregon State University
• Type of Incident: Penetration
• Number Affected: 4,700
• Source: ESI
• Abstract Source: Albany Democrat and Herald

Abstract
Oregon State Police are investigating the theft of the theft of online customer information from the Oregon State University bookstore. In total, the theft may affected 4,700 customers that had used credit cards in online purchases. The investigation began in March when a report indicated that 30 individuals may have been affected by a compromise of online orders. Last week the OSU Bookstore received numerous calls and e-mails alleging fraudulent credit card charges almost immediately following orders placed online through the OSU Bookstore. The bookstore immediately took down the affected servers and has worked to notify customers of the incident. According to the Oregon State Police, the incident appears to have originated from outside of the university.

Quick Facts

• Date: 6/3/2008
• Institution: University of California, Irvine
• Type of Incident: Penetration
• Number Affected: 1,132
• Source: Pogo Was Right
• Abstract Source: ComputerWorld

Abstract
A large number of ID theft crimes affecting University of California, Irvine medical students has been traced back to a data breach at UnitedHeathCare. A total of 1,132 current and former graduate students enrolled in the university's graduate student health insurance program could fall victim to tax scam. So far, 155 of these students have had criminals file false tax returns in the students name an collect the refunds. Only those students enrolled in the insurance program in 2006-2007 are affected. The University of California, Irvine has setup a web site - www.uci.edu/identitytheftalert/ - to answer questions about this incident.

Quick Facts

• Date: 5/30/2007
• Institution: University of Iowa
• Type of Incident: Penetration
• Number Affected: 946
• Source: Pogo Was Right
• Abstract Source: Iowa Press-Citizen, Iowa Press-Citizen

Quick Facts
The University of Iowa is alerting 946 current and former Center of Disabilities and Development employees following a recent computer breach. The university discovered that a computer application containing employee information such as dates of birth and Social Security numbers was accessed by an unknown, external individual before March 2008. The university is currently investigating the incident and has alerted the FBI.

Quick Facts

• Date: 5/15/2008
• Institution: Oklahoma State University - Stillwater
• Type of Incident: Penetration
• Number Affected: 70,000
• Source: ESI
• Abstract Source: The Daily O'Collegian, OSU - Stillwater Incident Alert
• Update1 Source: The Oklahoman

Abstract
Oklahoma State University - Stillwater is alerting staff and faculty that a parking server containing personal information was recently breached by an unknown individual(s). The server, used by the University's parking and transit services, housed a database containing the names, addresses, phone numbers, e-mail addresses and Social Security numbers on an unknown number of faculty and staff. After investigating the breach, OSU - Stillwater believes the attacker(s) breached the server for bandwidth and storage space, not the information housed on the system. However, OSU - Stillwater officials are working to notify any faculty or staff member that had purchased a parking permit between July 2002 and March 2008 just to be safe. President Burns Hargis called the security incident "totally unacceptable" and apologized for the incident. OSU - Stillwater has setup a website - idalert.okstate.edu/incident_00003.html - with more information.

Update1
The recent breach at Oklahoma State University affected a total of 70,000 students, faculty and staff. The university discovered the server breach back in March but waited until May to begin notifying individuals. According to officials the delay was due to an investigation to determine if the Social Security numbers had been accessed. The university was not able to make a determination. The affected server has been taken offline and the Social Security numbers have been removed.