Potential data breach reinforces University-wide prevention measures

In just the first three months of 2009, the Identity Theft Resource Center, a nonprofit organization that works to promote the understanding and prevention of identity theft, reported 133 data breaches on computer systems nationwide, potentially exposing more than 1.5 million records containing personally identifiable information such as Social Security and credit card numbers.

University-wide, Penn State provides anti-virus software for students, faculty members and staff, and uses an advanced intrusion detection system to continuously monitor the University’s information technology system. If a University computer is thought to have been compromised, the system immediately signals Penn State's Information Technology Services group to investigate the problem. On March 23, the University confirmed that 10,868 Social Security numbers in historical data on a computer at Penn State Erie, The Behrend College, could have been breached. It cannot be confirmed, however, that any of these Social Security numbers actually were released to a third party.

These longstanding security measures, designed to protect the network and systems from malicious software, alerted the University to the potential breach. As soon as the University became aware of the malicious software on this computer, the computer was immediately taken off line, data was examined and information was removed.

Even in cases such as this in which it cannot be determined with certainty that any data was pulled from a computer by infectious software, the University's policy is to take a cautionary stance and notify individuals who may have been affected. This response is in line with the Pennsylvania Breach of Personal Information Notification Act, which went into effect in 2006 and mandates that the University notify anyone whose personally identifiable information is potentially disclosed when a computer is lost or compromised.

"We have no reason to believe that this information was accessed by unauthorized individuals, but those affected should be alert in the event that an individual attempts to use their identity," said Bill Gonda, director of Marketing Communication at Penn State Behrend. "Our goal is to alert anyone who may have been affected, and arm them with information and steps to take to lessen their risk of identity theft — even if that theft is only a remote possibility."

Penn State is notifying those involved via letter. The letters will be mailed this Saturday, April 11, and will include contact information should recipients have further questions.

In addition to the existing structure to safeguard against malicious software, Penn State Behrend began participating in a University-wide scanning and encryption effort in January 2009 — the latest in a series of proactive measures that Penn State uses to safeguard the privacy of its students, faculty members, staff and alumni.

Through this initiative, University computers are being scanned for any data that could be personally identifiable information. The scanning, being done by technology not available until recently within the IT industry, is looking for personally identifiable data in historical documents.

In May 2008, Educause, the higher education technology consortium, released the results of its annual survey of top IT issues in higher education. The number one issue was security. The Identity Theft Resource Center said that 656 security breaches had been reported by the end of 2008, reflecting an increase of 47 percent over the 2007 total.

For more information, visit www.behrend.psu.edu.