|
It was probably a matter of time before it happened. My personal information was exposed in a data breach. On June 10, my alma mater, the University of Florida, announced that more than 11,300 current and former students had their names, addresses, student record information and Social Security numbers exposed online.
I'm one among many who have seen their personal information
lost or revealed in a breach. Linda Foley, the founder of the San
Diego-based Identity Theft Resource Center, says her nonprofit group
has counted 309 data breaches this year as of June 12, resulting
in the exposure of 16,795,000 known records total.
And UF isn't the only school to have trouble recently:
Earlier this week, the University of Utah Hospitals and Clinics
reported 2.2 million billing records were breached, 1.3 million
of which contained credit card data.
Here's what happened in my case and what you can take away from it.
 |
| Dealing with a data breach |
|
|
|
|
The announcement
The University of Florida breach affects students like me who were
enrolled in the College of Liberal Arts and Sciences between 2003
and 2005. Letters went out earlier this week to affected students,
but some 570 could not be located -- like me. I didn't bother to
forward my mail after graduating because I didn't have any debts
in my name at the time. And without updating my address with the
school, UF had no way to contact me.
Luckily, I found out through my subscription to a handy data breach list-serv from Attrition.org. I went straight to the UF Web site and proceeded to read about the breach.
Briefly here's what happened: Two student employees of the Office for Academic Support and Institutional Service, or OASIS, were creating a database of students participating in the OASIS program, which helps first-generation and minority students and faculty. They posted the records online so they could work on them from a remote location but did not "put in the security measures in place to keep others from accessing it," according to Steve Orlando, a spokesman for the University of Florida.
Some students' personal information was available for viewing without a password on the UF Web site since 2003. It was actively used until 2005 and then lay dormant on the Web site until discovery in May 2008. Orlando described the data as located "pretty deep within the UF Web site" and said that computer forensics revealed no proof that anyone else had accessed the information.
UF discovered the breach during a routine systems
audit -- a practice started shortly after a smaller breach in November
2007 at the College of Education. The online student records exposed
in this breach have been removed.
Orlando compared the incident to going on vacation and returning to an unlocked home with no signs of burglary. "That's kind of where we are. There's no indication that anybody got to this information or used it, but we can't be certain so that's why we're taking these measures for notification."
If you're not sure if you were affected, go to http://privacy.ufl.edu/, read the explanation and call the hot line provided if you have any questions.
Taking action
Because I knew I wouldn't get a notification letter, I called the
hot line provided on the university's privacy
homepage. They took my information and confirmed that, indeed,
I was one of those whose information was exposed and also one of
the folks they hadn't been able to contact. Lucky me.
|
