Lorenzo's Security Blog

Suffolk Community College has agreed to pay a company for the next year to monitor the credit of 300 students whose last names and Social Security numbers were mistakenly listed in an attachment to an e-mail sent to those students last

month.  [Donald: Okay, so where does Technology have anything to do with this human error and screw-up?]

Mary Lou Araneo, college vice president, said Sunday there is “no indication” that any of the personal information has been misused, but added that the college decided “it was the right step to take the extra precaution” to minimize students’ risk of identity theft. [Donald: The right thing to do? Okay so what does "no indication" mean? Who else had access to this information?  How many others received the attachment and is it still sitting on the email server?]

The error, said Araneo, occurred late in the day Sept. 17 and was discovered the next morning. She said college officials immediately shut down the server and took steps to retrieve unopened messages and attachments. She could not say how much of the personal information was recovered or whether anyone was disciplined for the security breach.  [Donald: Okay whoah....just a second.. previously Araneo said that no indication and now she can't say how much of the personal information was recovered? Let's get our stories straight here]

Araneo declined to comment on whether the college would be liable if student’s information was misused, saying such circumstances are “conjecture” at this point.

The same day the college learned of the problem, Araneo said school officials mailed a letter to inform students of the problem and alert them to immediate steps they could take to protect their personal data, including registering an alert with the three companies that monitor credit information.

Within a week, Araneo said the college sent a second letter, giving students directions on how to get the free credit monitoring service from Trans Union Llc for the next year. Araneo could not say how much the service will cost the college and TransUnion officials did not return calls for comment Sunday.

The college has campuses in Selden, Brentwood and Riverhead. Students affected were from all three.

In 2006, the Social Security numbers and birthdays of 3,900 college employees and former workers were made publicly accessible for two days on an Internet server. But school officials say the information was protected before it could be pilfered. [Donald: No technology involved here, just no oversight by compliance or

administrators trained to understand what is and is not sensitive information]

Later in 2006, a school security guard was arrested on identify theft charges for using the personal student and faculty information to make credit card purchases.  [Donald: Again, this does not involve Technology ("T") this is security awareness or lack there of it!]

Related articles by Zemanta

• Will your privacy be compromised online? (cnn.com)
• Kids Are Popular Targets for Identity Theft (hsh.com)
• Learn how to protect yourself from identity theft (arstechnica.com)
• Car dealers can use your drivers license … [Ssn] (consumerist.com)
• Top 10 Tactics for Protecting Your Stuff [Lifehacker Top 10] (lifehacker.com)