The theft of three desktop computers from the Advancement Services office at the University of Idaho in November may have put personal data of university alumni, donors, employees and students at risk.
An internal investigation by the university revealed that six months prior to the theft, the stolen hard drives contained datasets with names, addresses and Social Security numbers for about 70,000 individuals. The theft occurred during the Thanksgiving holiday and was discovered and reported by an employee in the universitys Advancement Services department. The incident remains under investigation by the Latah County Sheriffs Office, which asked the university to delay notification of the theft to preserve the integrity of the criminal investigation.
To date, school officials said they have no indication that the information has been accessed, misused or used for fraudulent purposes. As a precaution, the University of Idaho is making a broad public notification about the computer theft to approximately 331,800 individuals. The larger number represents the total amount of individuals whose information may have been accessed by Advancement Services as part of the offices work at the university. In-state residents are receiving an e-mail notice, and out-of-state residents are receiving a letter by regular mail.
“We deeply regret this incident and the worry and inconvenience it may cause, but we want to assure donors, alumni, students and employees that the University of Idaho is strengthening its processes for securing and storing our sensitive data,” said Timothy White, University of Idahos president.
Christopher Murray, vice president for university advancement, said the hard drives did not contain credit card numbers or personal account information.
“Our immediate concern is to alert those whose information may have been compromised,” said Murray.
The university has distributed a media alert, established a Web site with information about the incident and set up a telephone hotline at (866) 351-1860. The school has also taken steps to improve security, including removing sensitive information from specific computing devices and installing encryption software on desktop and laptop systems that access sensitive information, officials said.
To date, the stolen computers have not been recovered. Anyone with knowledge regarding the theft of the computers should contact Latah County Sheriffs Deputy Ron Vietmeier or Detective Tim Besst at (208) 882-2216.
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraines eWEEK Security Watch blog.