[May 13, 2006]

Data thieves prey on colleges: Schools becoming more vigilant to safeguard personal information

(Columbus Dispatch (Ohio) (KRT) Via Thomson Dialog NewsEdge) May 13--It's on file at the bookstore and the medical center. The admissions office, dining hall, athletic center have it, too, as do the professors.

Personal information is scattered everywhere on many college campuses. The wide use of basic information -- names, addresses, Social Security numbers -- has made colleges and universities a prime target for data security breaches. Many of Ohio's larger institutions have not been spared.

Just this week, Ohio University announced its third security breach since April 23. And since February of last year, universities nationwide have accounted for almost 50 percent of computer data theft, according to the Privacy Rights Clearinghouse, a nonprofit consumer advocacy group in San Diego.

"The reason is simple. Colleges have a tendency to use information, like Social Security numbers, for student IDs," said Jay Foley, executive director of the Identity Theft Research Center, another San Diego nonprofit.

Everyday tasks for college students -- filling out a form to get a parking pass, for example -- can require the use of a Social Security number, Foley said.

"I've seen colleges where professors print and post on the walls student names, IDs and their test scores," he said. "Universities aren't thinking about protecting, they're thinking about education."

As data thefts at colleges and universities nationwide become more publicized, schools say they're becoming more vigilant. Some are updating data systems; others have stopped using Social Security numbers as student IDs.

The University of Cincinnati will assign students and employees new numbers to replace their Social Security numbers this fall.

All say it's an ongoing job to tighten security. The University of Dayton is revamping its security and spreading the word about the dangers of data misuse.

"It's a huge task to do it across 15,000 machines," said Dean Halter, IT risk management officer at Dayton.

In OU's most recent database break-in, announced Thursday, the university said hackers found the Social Security numbers, addresses and birthdates of more than 60,000 individuals treated at OU's Hudson Health Center.

The university uncovered the third break-in while investigating a previous one, in which hackers accessed a database containing the Social Security numbers of 137,000 alumni. The university announced that breach May 1.

The first breach, discovered by the FBI in mid-April, involved OU's Technology Transfer Center, where a server holds research and patent information.

The university said it has been notifying all affected individuals by mail and e-mail. It has developed an informational Web site, www.ohio.edu/datasecurity/index.cfm, and has been working to tighten security, said Bill Sams, associate provost for information technology and chief information officer.

Besides Cincinnati and Dayton, security issues have touched the Kent State, Miami and Cleveland State universities, as well as the Ohio State University Medical Center in the past year. Some have been computer thefts or hacking, while in other cases personal information was accidentally posted online. Many of the schools are updating systems and urging those on campus to be careful when storing personal information.

OSU will not comment on data security issues so as not to compromise them, university spokeswoman Amy Murray said. The university was not mentioned on the data-theft report from the Privacy Rights Clearinghouse.

According to the Identity Theft Data Clearinghouse, a division of the Federal Trade Commission, people ages 18-29 make the most reports of identity theft in Ohio and the nation. Ohio ranks 29 th in the nation in reports of identity theft.

UC spokesman Greg Hand said the university regularly tests its systems. But a breach can be a "wake-up call" for weak areas.

So far, there have been few reports of fallout from information stolen from Ohio colleges. At OU, about a dozen people have reported problems since the data breaches, but officials don't think the recent break-ins were to blame for most of them.

Still, experts say victims count on colleges to keep their personal information safe.

"How long do you think it's going to be before somebody comes forward and tries to hold the university liable for the information being lost?" Foley said.

Dispatch reporter Jennifer Smith Richards contributed to this story.

akolodziej@dispatch.com

[ Back To TMCnet.com's Homepage ]

Discussions: