| |
|
Tuesday, December 12, 2006
|
|
A
sophisticated computer hacker has illegally and fraudulently accessed a
restricted UCLA database containing names and certain personal
information. This database includes UCLA's current and some former
students, faculty and staff, some student applicants and some parents
of students or applicants who applied for financial aid. The database
also includes current or former staff and faculty of the University of
California, Merced, and current or former employees of the University
of California Office of the President, for which UCLA does
administrative processing.
UCLA is notifying all of those
individuals in the database, even though a continuing investigation
indicates that the computer trespasser sought and obtained only some of
the information. There is no evidence to suggest that personal
information has been misused.
UCLA greatly regrets the concern and inconvenience caused by this illegal activity.
This
Web site has been established to provide information to those who
received a notification and those who believe they may be affected by
this incident. Those who don't know whether they are in the compromised
database are encouraged to contact the Identity Alert Hotline
established by UCLA. The phone number is (877) 533-8082. |
|
|
 |
10:24:59 PM 
|
|
LOS ANGELES (AP) -- The University of California,
Los Angeles alerted about 800,000 current and former students, faculty
and staff on Tuesday that their names and certain personal information
were exposed after a hacker broke into a campus computer system. Only
a small percentage -- ''far less than 5 percent'' -- of the records in
the database were actually accessed, UCLA spokesman Jim Davis told The
Associated Press. Still, it was one of the largest such breaches involving a U.S. higher education institution. The
attacks in October 2005 and ended Nov. 21 of this year, when computer
security technicians noticed suspicious database queries, according to
a statement posted on a school Web site set up to answer questions
about the theft. Davis said the hacker used a program designed to
exploit an undetected software flaw to bypass security and get into the
restricted database, which has information on current and former
students, faculty and staff, and some student applicants and parents of
students or applicants who applied for financial aid. Many of the
records in the database do not link names and Social Security numbers,
however, the two pieces of information the hacker was after, Davis said. The
university's investigation so far shows only that the hacker sought and
obtained some of the Social Security numbers. Out of caution, the
school said, it was contacting everyone listed in the database. About
3,200 of those being notified are current or former staff and faculty
of UC Merced and current or former employees of the University of
California Office of the President, for which UCLA does administrative
processing.
10:22:33 PM
|
|
UCLA is alerting
approximately 800,000 people that their names and certain personal information
are contained in a restricted database that was illegally and fraudulently
accessed by a sophisticated computer hacker.
This database
contains certain personal information about UCLA's current and some former
students, faculty and staff, some student applicants and some parents of
students or applicants who applied for financial aid. Approximately 3,200 of
those being notified are current or former staff and faculty of the University of California,
Merced, and current or former employees of the University of California Office of the President, for
which UCLA does administrative processing.
In a letter
being sent to affected individuals, Acting Chancellor Norman Abrams said that
personal information about at least some of the individuals was obtained by the
hacker but that there is no evidence that any data has been misused. The
database includes names, Social Security numbers, dates of birth, home
addresses and contact information. It does not include driver's license numbers
or credit card or banking information.
"We take our
responsibility to safeguard personal information very seriously," Abrams said.
"My primary concern is to make sure this does not happen again and to provide
to the people whose data is stored in the database important information on how
to minimize the risk of potential identity theft and fraud."
UCLA blocked
access to the Social Security numbers and the database when suspicious activity
was detected on Nov. 21 and immediately activated its information technology
security incident team. UCLA also notified the FBI, which is conducting an
investigation.
Even though
UCLA's ongoing investigation at this time indicates only that the hacker sought
and obtained some of the Social Security numbers, out of an abundance of
caution, the university decided to notify all 800,000 people whose names are
listed in the restricted database.
10:20:08 PM
|
|
The University of California, Los Angeles, has announced this morning
that the personal information of some 800,000 current and former
students had been contained in a restricted database "that was
illegally and fraudulently accessed by a sophisticated computer
hacker."
According to the Associated Press,
the attacks began in October of last year, and continued through Nov.
21, when a spike in queries to the database tipped off security staff
that something was amiss. The database contained the usual sorts of
information that thieves can use to open new lines of credit using a
victim's identity: names, Social Security numbers, dates of birth, home
addresses and contact information.
Letters are being sent out to all 800,000 individuals affected.
For those who like to keep track, this becomes the largest data
breach at an educational institution to date -- at least as measured by
the Privacy Rights Clearinghouse, which maintains a fairly comprehensive list of data breaches dating back to the Choicepoint incident, announced in February 2005, which essentially brought the issue of data security to the national consciousness.
10:17:49 PM
|
|
|
© Copyright 2007 Paul Hardwick.
Last update: 1/2/07; 4:22:30 AM.
|
|
|
