UC Berkeley hacking leaves 160,000 at risk of ID theft

Colleges and Universities A-Z University of California - Berkeley
1

<p>UC</a> hacking leaves 160,000 at risk of ID theft</p>

<p>"Overseas hackers may have stolen confidential information belonging to tens of thousands of students and alumni at UC Berkeley and Mills College after gaining access to computer databases at the Berkeley campus' health services center, officials said today.</p>

<p>The databases contained Social Security numbers, health-insurance information and non-treatment medical information, such as immunization records and names of some of the doctors that people may have seen and dates of medical visits, said campus spokeswoman Janet Gilmore.</p>

<p>The hackers had access to the information for six months before they were discovered. The breach exposed 160,000 people to possible identity theft, Gilmore said. The university is contacting potential victims, who should consider placing a fraud alert on their credit reporting accounts, she said.
Among those at risk are 3,400 students at Mills College in Oakland who received, or were eligible to receive, health care at UC Berkeley.</p>

<p>Hackers had access to records of students and alumni at UC Berkeley dating back to 1999 and current and former Mills students going back to 2001. Spouses and parents are also vulnerable if they were linked to students' insurance coverage.</p>

<p>The hackers had access to the computer system from last Oct. 9 until April 9, when administrators performing routine maintenance discovered messages they had left, UC said.</p>

<p>Investigators suspect that the overseas hackers accessed a public Web site and then bypassed additional secured databases stored on the same server, Gilmore said. Officials did not say in which country the hackers were based.</p>

<p>UC has notified the FBI about the security breach.</p>

<p>"The university deeply regrets exposing our students and the Mills community to potential identity theft," said Shelton Waggener, UC Berkeley's associate vice chancellor for information technology and its chief information officer. "We are working closely with law enforcement and information security experts to identify the specific causes that may have contributed to this breach and to implement recommendations that will reduce our exposure to future attacks."</p>

<p>University officials stressed that hackers had not obtained medical records - including diagnoses, treatments and therapies - because they are stored in a separate system. However, some students who participated in UC Berkeley's Education Abroad Program may have had their self-reported health records stolen, Gilmore said.</p>

<p>The campus is sending out e-mails and letters today to potential victims of the latest attack. People with questions can call a hot line, (888) 729-3301.
The incident is the latest security breach at UC Berkeley, which has been victimized by hackers in previous high-profile incidents.</p>

<p>In 2005, someone stole a laptop computer containing Social Security numbers of more than 98,000 graduate students, graduate school applicants and other individuals.</p>

<p>In 1998, a high-tech intruder broke into computer accounts at UC Berkeley and other places around the world, decoding nearly 48,000 passwords in what experts then said was one of the largest known collections of stolen access codes.</p>

2

<p>i got that email too…
what are we suppose to do…?</p>

3

<p>Did you get the general email or the specific one? If YOUR data was stolen, they send a message telling you and specifying what steps you can take. Here is a snippet of what they said in their specific email:</p>

<p>

</p>

4

<p>i think i got the general email…</p>

<p>Dear Associate of UC Berkeley, </p>

<p>We are writing to you because UC Berkeley`s University Health
Services, UHS, recently learned that criminal computer hackers broke
into electronic databases containing personal information belonging to
some UHS clients and their parents or spouses.

Although the investigation is still underway, we wanted to alert you as soon as possible that some of your personal information, including your Social Security number stored on those databases, was stolen, which puts you at risk for identity theft. It is also possible that your parents or guardian or spouse`s information was taken if you waived enrollment in the Student Health Insurance Plan, and they were the policy holder of your health coverage.</p>

<p>In addition, the criminals may have stolen information related to your
health insurance coverage and some of your non-treatment medical
information such as Hepatitis B immunization history, UHS medical
record number, dates of visits or names of providers seen, or for
participants in the Education Abroad Program, certain information from
the self-reported health history. You will receive a second
notification letter from us if, in addition to your Social Security
number, this information was also stolen.</p>

<p>Please be assured that UHS electronic medical records, including
patient diagnoses, treatments and therapies, are stored in a separate
system and were not affected in this incident.</p>

<p>We sincerely regret and apologize for any difficulty that this theft
may create for you. We have alerted campus police detectives and the
FBI, and we are doing all that we can to investigate this crime. We
are also dedicated to assisting you with information about the
incident and services that can help prevent or minimize the impact
this theft may have on you.</p>

<p>Protecting Your Personal Information</p>

<p>Attached to this letter is a resource sheet to assist you with steps
that you may wish to take to protect your identity and credit. As a
precautionary measure, we urge you to create immediately a no-cost,
formal fraud alert on your consumer credit file. If someone attempts
to open a new credit card account in your name, this service will
monitor activity on your account.</p>

<p>We have also established a Data Theft Hotline, 888-729-3301. Trained
personnel will be available 24 hours a day, 7 days a week to help you
determine the full extent of your personal exposure and assist you
with information about credit and identity protection services. When
you call, you will be asked to provide personal information to
validate your identity.</p>

<p>Additional information can also be found on our dedicated web site:
[Data</a> theft: UC Berkeley](<a href=“http://datatheft.berkeley.edu%5DData”>http://datatheft.berkeley.edu)</p>

<p>Background Information about the Theft</p>

<p>UC Berkeley computer administrators determined on April 21, 2009 that
restricted electronic databases had been illegally accessed by
hackers, and that the data thefts began on October 9, 2008, and
continued until April 6, 2009. All of the exposed databases were
immediately removed from service to make sure that they would be
completely protected from any future attacks. To ensure that we fully
understand the nature of the security breach and to determine the
steps that we can take to minimize the risk of a reoccurrence, the
university has hired an outside auditor, Price Waterhouse Coopers, to
support our ongoing investigation of the incident.</p>

<p>Finally, please be aware that sometimes in these situations, dishonest
people falsely identifying themselves as UC Berkeley representatives
may contact you and offer assistance with the intention of obtaining
more personal information from you. If you call our Data Theft Hotline
the operator will need to ask for information to validate your
identity, but we want to assure you that UC Berkeley will not contact
you by phone, e-mail or any other method to ask you for personal
information. If you are uncertain about any inquiry, please call our
hotline directly.</p>

<p>Sincerely,</p>

<p>Steve Lustig
Associate Vice Chancellor, Health and Human Services</p>

<p>Shelton Waggener
Associate Vice Chancellor & Chief Information Officer</p>

<p>Understanding and Protecting Yourself from Identity Theft </p>

<p>People who have had personal information stolen are at risk if they do
not take steps to protect their identity. According to a Federal Trade
Commission report, most identity theft involves the illegal use of
credit card, bank, utilities, and other existing accounts.
Fortunately, there are steps, described below, that you can take to
protect yourself and your credit. In addition, extensive information
on personal identity theft and fraud and protective steps you can take
is available on the Web site of the California Office of Privacy
Protection, a division of the state Department of Consumer Affairs,
[Consumer</a> Privacy - California Office of Information Security and Privacy Protection (OISPP)](<a href=“http://www.privacy.ca.gov%5DConsumer”>http://www.privacy.ca.gov).</p>

<p>PLACING A FRAUD ALERT
By placing a fraud alert on your consumer credit file, you let
creditors know that they should watch for unusual or suspicious
activity in any of your accounts, such as someone trying to open a
credit card account in your name.</p>

<p>To place a free fraud alert, call one of the three major credit
reporting agencies listed below.
Your phone call will take you to an automated phone system. Be sure to
listen carefully to the selections and indicate that you are at risk
for credit fraud. You need only contact one of these agencies, which
will automatically forward the fraud alert to the other two. These
agencies offer the initial fraud alerts at no charge.</p>

<p>Equifax
888-766-0008
Consumer Fraud Division
P.O. Box 740256
Atlanta, GA 30374
[Equifax:</a> Credit Reports, Credit Scores, Protection Against Identity Theft](<a href=“http://www.equifax.com%5DEquifax:”>http://www.equifax.com)
Equifax home page
[Equifax</a> Online Help: How to Set a Fraud Alert](<a href=“http://www.equifax.com/answers/set-fraud-alerts/en_efx]Equifax”>http://www.equifax.com/answers/set-fraud-alerts/en_efx)
Equifax fraud alert information page</p>

<p>Experian
888-397-3742
Credit Fraud Center
P.O. Box 1017
Allen, TX 75013
[Credit</a> Report and free credit score at Experian.com](<a href=“http://www.experian.com%5DCredit”>http://www.experian.com)
Experian home page
<a href=“https://www.experian.com/consumer/cac/InvalidateSession.do?code=SECURITYALERT[/url]”>https://www.experian.com/consumer/cac/InvalidateSession.do?code=SECURITYALERT&lt;/a&gt;
Experian credit fraud page
[Experian</a> | Consumer Credit Fraud | FAQ](<a href=“http://www.experian.com/consumer/fraud_faqs.html#security]Experian”>http://www.experian.com/consumer/fraud_faqs.html#security)
Experian credit fraud FAQ</p>

<p>TransUnion
800-680-7289
Fraud Victim Assistance Department
P.O. Box 6790
Fullerton, CA 92834
[TransUnion</a> - Check Your Credit Report and Credit Score Online, Instantly and Securely](<a href=“http://www.tuc.com%5DTransUnion”>http://www.tuc.com)
TransUnion home page
[TransUnion</a> Personal: Fraud Alert](<a href=“http://www.transunion.com/corporate/personal/fraudIdentityTheft/fraudPrevention/fraudAlert.page]TransUnion”>http://www.transunion.com/corporate/personal/fraudIdentityTheft/fraudPrevention/fraudAlert.page)
TransUnion fraud page</p>

<p>Soon after you place a fraud alert, you will receive credit reports by
mail from all three reporting agencies. In the credit report, check
your personal information, including home address, Social Security
number, etc., for accuracy. Look for any charges that you did not
make. Watch for any accounts that you did not open. Note any
inquiries from creditors that you did not initiate.</p>

<p>If you find anything that looks suspicious or that you do not
understand, call the credit agency at the telephone number listed on
your credit report. You may also wish to call your local police or
sheriff`s office to file a report of identity theft.

PLACING A SECURITY FREEZE A security freeze means that your credit file cannot be shared with potential creditors unless you give your consent. If your credit files are frozen, even someone who has your name and Social Security number would probably not be able to obtain credit in your name. If you take this step any new creditors that request your file from one of the three credit bureaus will only obtain a message or a code indicating that the file is frozen. While you will be able to lift the freeze for legitimate inquiries, you should be aware that this can slow any credit approval process.

A security freeze is free to those who have a police report of verified identity theft. To obtain a police report, contact your local police department. Give the police as much information on the theft as possible. One way to do this is to provide copies of your credit reports showing the items related to identity theft. Black out other items not related to identity theft. Give the police any new evidence you collect to add to your report. Be sure to obtain a copy of your police report. You will need to give copies to creditors and the credit bureaus.

If you do not have a police report, it costs $10 to place a freeze with each credit bureau, for a total of $30. The credit bureaus require that freeze requests be made in writing.

Samples of freeze request letters can be found at: http://www.oispp.ca.gov/consumer_privacy/consumer/documents/pdf/cis10securityfreeze.pdf

Equifax Security Freeze P.O. Box 105788 Atlanta, GA 30348 Send by certified mail. Include name, current and former address, Social Security number and date of birth. Pay by check, money order or credit card, Visa, Master Card, American Express or Discover only. Give name of credit card, account number and expiration date.

Experian Security Freeze P. O. Box 9554 Allen, TX 75013 Send by certified mail. Include full name, with middle initial and Jr./Sr., etc. Include current address and home addresses for past five years, Social Security number, birth date and two proofs of residence, such as a copy of driver's license, utility bill, insurance statement, bank statement. Pay by check, money order or credit card. Give name of credit card, account number and expiration date.

TransUnion Security Freeze P. O. Box 6790 Fullerton, CA 92834 Send by regular or certified mail. Include first name, middle initial, last name, Jr./Sr., etc. Current home address and addresses for past five years, Social Security number and birth date. Pay by check, money order or credit card. Give name of credit card, account number and expiration date.

Additional information on how to initiate a Security Freeze can be found on the Web site of the California Office of Privacy Protection: http://www.oispp.ca.gov/consumer_privacy/consumer/documents/pdf/cis10securityfreeze.pdf

CREDIT MONITORING This service will send you e-mail alerts when new accounts, inquiries, negative information, credit-limit changes, and other items appear on your credit report. The following firms all offer credit monitoring services on a monthly basis with prices ranging from $4.95 to $14.95 a month. Please note that Federal Trade Commission and country`s leading consumer groups do not endorse this particular service. They suggest that signing up for a free Fraud Alert and placing a Security Freeze on your credit file offers a higher level of protection.</p>

<p>Experian: [Protect</a> yourself from identity theft with Credit Monitoring from TripleAlert.com](<a href=“http://www.experiandirect.com/triplealert/default.aspx?sc=668715]Protect”>http://www.experiandirect.com/triplealert/default.aspx?sc=668715)
True Credit:
<a href=“https://www.truecredit.com/products/optimizedOrder.jsp?package=TriBureauCMU[/url]”>https://www.truecredit.com/products/optimizedOrder.jsp?package=TriBureauCMU&lt;/a&gt;
Identity Guard: [Get</a> IDENTITY GUARD Total Protection: Credit, Internet, Computer, On-the-Go](<a href=“http://www.identityguard.com/getprotected/landing.aspx]Get”>http://www.identityguard.com/getprotected/landing.aspx)
Equifax: [Equifax</a> ID Patrol: Identity Theft Protection & Daily Credit Monitoring](<a href=“http://www.equifax.com/id-patrol/]Equifax”>Credit Monitoring & Identity Theft Protection | Equifax)</p>

5

<p>I got the general email just now.</p>

6

<p>wait… is mine the general or… specific one lol. can’t tell</p>

7

<p>No, mine only has a short letter from the associate dean. Not all that extra stuff.</p>

8

<p>

</p>

<p>^that’s the one I got.</p>

9

<p>^
yea i got that one… and the one i posted before ><</p>

10

<p>88888888, you got the specific email. Note the beginning of the second paragraph:</p>

<p>

</p>

<p>This is not fun. But at least we are in it together.</p>

11

<p>eh… ok thanks off to sproul</p>

12

<p>oh… crap… no wonder… my mom said… some berkeley person called…for my information… hopefully my mom didn’t give it out… im gonna call her now</p>

13

<p>Yeaaaaah. I got two of those emails. Dangit. :[</p>

<p>At least I just requested a credit report, and it won’t be too hard to call in a watch on my SSN. Siiiigh. Happy graduation to me. XD</p>

14

<p>My roommates and I all got the 2 emails…I just send out an email to my family telling them NOT to give out any info.</p>

15

<p>just wondering, but… how the heck does someone get away with this for several months before someone even knew they did it ?? wth…</p>

16

<p>i can just request a credit report from Equifax, Experian or TransUnion si?</p>

17

<p>You can request a credit report from any one of them, but unless you’re sure which credit union your account’s with (and therefore open to identity theft), you should check with all of them. I’m just going to get the fraud alerts on all three and order credit reports. </p>

<p>Damn, and right before finals too.</p>

18

<p>meh… :(</p>

19

<p>This sucks!</p>

20

<p>does anyone know if this affects incoming freshman???</p>