ID Alert home
Who was affected?
Protecting your credit
>Q&A
Resources
Contact us |
ID Alert: Questions and answers
Q. What happened?
A. Over the weekend of April 16, 2004, a security breach was discovered on two computers in Business & Financial Services, an administrative department at UCSD. An examination showed that that one or more unauthorized users had accessed them via the Internet. The PCs were immediately removed from the network, followed by an emergency assessment of the computing environment. During this assessment, additional areas of concern were identified that included two workstations.
While there is no indication that the personal data on these computers was accessed, records of personal data for approximately 380,000 individuals were stored on the machines and could have been viewed by an unauthorized intruder.
Q. Do you know who the hacker was or what motivated the attack?
A. It is extremely difficult to identify the absolute source of these types of transgressions. We do know that one or more unauthorized users appear to have used disk space for DVD storage, perhaps as part of a file-sharing activity.
Q. Multiple computers were attacked. Do you know if the incidents are related?
A. There is no direct evidence that the incidents are related, though it is possible that at least two of the incidents were part of the same automated attack. Such automated attacks are constant on the internet.
Q. Exactly what kind of information was exposed, and do you know if it was actually accessed?
A. The information on the compromised machines included names and personal identifiers (such as Social Security numbers or driver’s license numbers) for approximately 380,000 former and current students, staff and faculty as well as some applicants who never enrolled at UCSD. While we do not know and have no evidence that this data was actually accessed, we wanted to advise the affected parties of the potential exposure as quickly as possible.
Q. How can I find out if my information was on these computers?
A. The University will send letters to affected individuals over the next few weeks, as we confirm current addresses. If you have not received a notification letter within two weeks and are concerned that you may be affected, you can e-mail idalert@ucsd.edu or call (866) 890-5560, toll-free.
Q. What have you done to inform students, staff, and other affected parties about the problem?
A. We have moved as quickly as possible to accurately assess the situation and to inform our students, staff, alumni, faculty, and others that a security breach has occurred and their personal information could have been viewed illegally. We are in the process of sending letters to the impacted individuals and have also alerted the news media to help us spread the word.
Q. What can affected individuals do to protect themselves?
A. To prevent or mitigate any potential identity theft problems, we recommend you set a fraud alert on your credit report and then review a copy for any suspicious activity.
Please note: Because UCSD has released a notice of this event to the media, disreputable people might contact affected individuals to “help,” falsely identifying themselves as affiliated with the University. UCSD will not contact you by phone or any other method asking you for private information. Please do not release any private information in response to any contacts of this nature.
Q. Do I have to pay for a credit report?
A. No. If you have been affected by this incident and you place a fraud alert, we have been told that you will receive copies of your credit report at no charge.
Q. What are you doing to prevent further problems like this?
A. Campus data-security experts and other information technology specialists are evaluating the details of this incident and the existing security efforts to determine how to prevent this kind of incident from happening again. Because of the open and collaborative nature of a research institution like UCSD, system security is extremely complicated, but we are committed to enforcing existing standards and developing new standards as needed to safeguard the integrity of our systems and protect the data with which we have been entrusted.
Q. Has this happened at other universities?
A. Over the last five years, there has been a notable increase in hacking activity aimed at colleges and universities, institutions that are known for their culture of openness and the sharing of information. Also, because of their high bandwidth, university networks are also attractive to those engaged in file sharing. Computer security systems storing personal student and employee information have been breached recently at numerous universities, including University of Texas, New York University, and other CSU and UC campuses.
Q. Is there a criminal investigation?
A. Yes. Appropriate law enforcement agencies have been contacted and are aware of this incident. An investigation is under way.
|
