UCLA Hacked, 800,000 Identities Exposed

An anonymous reader writes "The Washington Post reports that a central campus database at UCLA containing the personal information (including SSNs) of about 800,000 UCLA affiliates has been compromised for possibly over a year. The data may have been available to hackers since October 2005 until November 21, 2006, when the breach was finally detected and blocked. Several other UC campuses have also been involved in significant data security incidents over the past few years." From the article: "'To my knowledge, it's absolutely one of the largest,' Rodney Petersen, security task force coordinator for Educause, a nonprofit higher education association, told the Los Angeles Times. Petersen said that in a Educause survey release in October, about a quarter of 400 colleges said that over the previous 12 months, they had experienced a security incident in which confidential information was compromised, the newspaper reported."

wow!

[jrwr00]

Watch your bank accounts people this could be a long one,

800,000 people are going to be pissed as shit

Re:

[Oddscurity]

And with good reason. This having gone undetected for a year shows there must be something very wrong with their IT department, like blind faith in their security? Isn't it reasonable to audit your systems, particularly those with sensitive information like this?

Re:

[x1101]

apparently not to the people of UCLA. "security audit, who needs that, we have never had a break in be..Sir, someone just informed me that a large number of our student records may have been compromised"

Re:wow!

[atrizzah]

My name was on the list. Hooray!

I was just about to submit this story myself. Here's UCLA's official website devoted to the whole incident: Link [ucla.edu]

I wonder, will there be a point in time when we hold accountable either the credit agencies for their broken system or organizations we are forced to trust with our data for not keeping it safe?

Re:wow!

[voice_of_all_reason]

I wonder, will there be a point in time when we hold accountable either the credit agencies for their broken system or organizations we are forced to trust with our data for not keeping it safe? Sure. But it's up to you. Here's a handy guide for redressing your grievances: http://en.wikipedia.org/wiki/Storming_of_the_Basti lle [wikipedia.org]

Re:wow!

[pilgrim23]

There is only one possible way to protect yourselves these days: Lie. If someone needs your info, or SAYS they need your info ("I am sorry sir but our regulations clearly state you must fill out this form") then lie, fib, tell an untruth! For years I have always typoed a number or two on my SSN on forms, mis-spelled my name, screwed up the address, etc. I never commit outright fraud, but I DO use tecnhiques that will screw up their database. If more of us just smiled shrugged and said "oh well" to these data leeches in this simple manner, the problem would go away due to the general unreliability of the database,

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[pilgrim23]

It must have worked fine: My address and other data was not on any burglarized laptop, hacked by Bulgarian ID thieves, left on a table at Starbucks or otherwise treated with all the due diligence our academic institutions are known for...

And how do you remember what you wrote?

[vinn01]

The whole point of getting your SSN is to set up an account for your data.

If you lie, you had better be able to remember what you wrote - otherwise good luck getting access to your account.

Re:

[necro2607]

I do the same thing all the time when signing up for ... well, just about anything. Most often I misspell my last name as it is very unique. Of course typo a digit or two in the phone number... and for special cases I've devised a full legit address for some town out in the boonies in Ohio... and I live in Canada. ;) I wonder if that house ever gets mail addressed to my name...

Re:

[trentblase]

I pretend to reside in Schenectady, NY - zip code 12345

Re:

[k2enemy]

800,000 people are going to be pissed

especially people like me who applied to the school years ago and never attended. why are they storing SSNs of people that are not students or employees? my info should have never been in there to steal in the first place.

Re:

[CastrTroy]

Why did you give them your SSN when they had no use for it?

Re:

[k2enemy]

they did have a use for it, but after it was clear that i would not be attending UCLA they no longer had a need for it and should not have retained it.

Re:wow!

[ObsessiveMathsFreak]

800,000 people are going to be pissed as shit

Correction.

11 people are going to be pissed as shit.
34 people are going to panic.
72 people are going to wonder if the story is relevant to them.
284 people aren't going to realise the story is relevant to them.

799599 people affected aren't even going to hear about this, let alone care.

There is a silent majority. It's silent because its too apathetic to speak.

Re:

[topical_surfactant]

They emailed everyone they had addresses for on that list. The "I care" numbers are probably a bit higher, especially considering that many of them were graduate school applicants.

Re:

[Anonymous Coward]

This isn't going to show up on your monthly bank statement.

Criminals typically do one of three things with a Name/DOB/SSN:

1) Try to obtain credit in your name
2) Open a bank account and use it for money laundering, bogus checks, ebay fraud, and various other scams
3) Give your info when they get arrested

1) will show up on your credit report eventually. With 2) or 3) you might not find out about it for awhile.

E-mail sent to UCLA students, faculty, and staff

[George Maschke]

December 12, 2006

Dear Friend,

UCLA computer administrators have discovered that a restricted campus database containing certain personal information has been illegally accessed by a sophisticated computer hacker. This database contains certain personal information about UCLA's current and some former students, faculty and staff, some student applicants and some parents of students or applicants who applied for financial aid. The database also includes current and some former faculty and staff at the University of California, Merced, and current and some former employees of the University of California Office of the President, for which UCLA does administrative processing.

I regret having to inform you that your name is in the database. While we are uncertain whether your personal information was actually obtained, we know that the hacker sought and retrieved some Social Security numbers. Therefore, I want to bring this situation to your attention and urge you to take actions to minimize your potential risk of identity theft. I emphasize that we have no evidence that personal information has been misused.

The information stored on the affected database includes names and Social Security numbers, dates of birth, home addresses and contact information. It does not include driver's license numbers or credit card or banking information.

Only designated users whose jobs require working with the restricted data are given passwords to access this database. However, an unauthorized person exploited a previously undetected software flaw and fraudulently accessed the database between October 2005 and November 2006. When UCLA discovered this activity on Nov. 21, 2006, computer security staff immediately blocked all access to Social Security numbers and began an emergency investigation. While UCLA currently utilizes sophisticated information security measures to protect this database, several measures that were already under way have been accelerated.

In addition, UCLA has notified the FBI, which is conducting its own investigation. We began notifying those individuals in the affected database as soon as possible after determining that personal data was accessed and after we retrieved individual contact information.

As a precaution, I recommend that you place a fraud alert on your consumer credit file. By doing so, you let creditors know to watch for unusual or suspicious activity, such as someone attempting to open a new credit card account in your name. You may also wish to consider placing a security freeze on your accounts by writing to the credit bureaus. A security freeze means that your credit history cannot be seen by potential creditors, insurance companies or employers doing background checks unless you give consent. For details on how to take these steps, please visit http://www.identityalert.ucla.edu/what_you_can_do. htm [ucla.edu].

Extensive information on steps to protect against personal identity theft and fraud are on the Web site of the California Office of Privacy Protection, a division of the state Department of Consumer Affairs, http://www.privacy.ca.gov [ca.gov].

Information also is available on a Web site we have established, http://www.identityalert.ucla.edu [ucla.edu]. The site includes additional information on this situation, further suggestions for monitoring your credit and links to state and federal resources. If you have questions about this incident and its implications, you may call our toll-free number, [phone].

Please be aware that dishonest people falsely identifying themselves as UCLA representatives might contact you and offer assistance. I want to assure you that UCLA will not contact you by phone, e-mail or any other method to ask you for personal information. I strongly urge you not to rel

Re:E-mail sent to UCLA students, faculty, and staf

[Chabil Ha']

A security freeze means that your credit history cannot be seen by potential creditors, insurance companies or employers doing background checks unless you give consent.

Gee, it isn't that way by default? I would expect that that information too would be safeguarded...

What are the credit implications for placing a freeze on that information? Does it affect credit scores in any way? If not, I would like to place one on my own, just for fact that I don't want anybody looking at that information withou

Re:

[Lloyd_Bryant]

A security freeze means that your credit history cannot be seen by potential creditors, insurance companies or employers doing background checks unless you give consent.

Gee, it isn't that way by default? I would expect that that information too would be safeguarded...

Nope. Unless you've specified such a freeze, anyone who has subscribed to the credit bureau can see your credit history. Credit card companies routinely scan such histories to determine who to send those unsolicited "You have been approved f

Re:E-mail sent to UCLA students, faculty, and staf

[Beryllium Sphere(tm)]

Yes, should be the default, but you can't even get a security freeze unless you live in a state that forces the credit bureaus to do it. California is one.

It should be illegal to treat the SSN as proof of identity anyway. What kind of password has the following properties?
o Less than a billion possible values
o Part of it based on your place of birth
o You're required to disclose it to dozens or hundreds of places
o Any credit-granting company can order a report and look at it
o It never changes

Re:E-mail sent to UCLA students, faculty, and staf

[lawpoop]

"I regret having to inform you that your name is in the database."

He regrets having to inform us, not that they were hacked.

Re:

[thePowerOfGrayskull]

"I regret having to inform you that your name is in the database."

He regrets having to inform us, not that they were hacked.

For that matter, he doesn't even regret that your name was in the database -- only that he has to tell you about it.

Liked this quote

[Gription]

The line I liked best was the last line of the second paragraph, "I emphasize that we have no evidence that personal information has been misused.

The line doesn't add anything except the realization that they are trying to cover their ass. Of course they don't have any evidence of what the intruder did with the data.

They do have proof of misuse though... Unauthorized access is misuse!

Re:

[trentblase]

Of course they don't have any evidence of what the intruder did with the data.

You mean the sophisticated hacker. Is anyone else interested in what evidence they have that this was the work of a formidable enemy rather than mere incompetence on their part?

Re:E-mail sent to UCLA students, faculty, and staf

[neoshmengi]

You may also wish to consider placing a security freeze on your accounts by writing to the credit bureaus. A security freeze means that your credit history cannot be seen by potential creditors, insurance companies or employers doing background checks unless you give consent.

Why isn't this automatic? Nobody should have the ability to check someone's credit without their consent. It should be the 'default' setting.

One way to help protect...

[s31523]

When I was in a U.S. college, albeit a long time ago i.e. before Patriot Act and 9/11, I had the choide to use a random number as my student ID rather than my social security number. I remember hearing that the soc. security number is(was? pre 9/11) only required for social security and tax purposes. I think more places should start using other numbers. Although this wouldn't solve hacked identity theft, it is one less piece of information that the hackers get...

Re:

[denebian devil]

When I was in a U.S. college, albeit a long time ago i.e. before Patriot Act and 9/11, I had the choide to use a random number as my student ID rather than my social security number. I remember hearing that the soc. security number is(was? pre 9/11) only required for social security and tax purposes. I think more places should start using other numbers. Although this wouldn't solve hacked identity theft, it is one less piece of information that the hackers get...

Except that would just mean that when the hackers get their spreadsheet full of information on 800,000 people, they just have to remember to look to the "SSN" column instead of the "Student ID" column to get the information they want. The school will still collect your SSN whether they use it as your ID or not. The question merely becomes whether it is your SSN or some randomly generated number that they put on your ID card.

Re:One way to help protect...

[s31523]

I actually refused to give my social security number to the school (again this was pre 9/11 and Patriot Act) because when I asked why they needed it they said for administrative purposes only. After my unwillingness to give it up they said, "well sir, we can assign you a generic ID number, but that will be really hard to remember and most students choose their soc. number because they can remember it. Are you sure you want to do this?". So, in my case the soc. sec. column had a generic number (which was 11 digits, instead of 9).

Re:

[CastrTroy]

I don't see the argument for it being too hard to remember. Mind you, my student ID number was 7 digits and not 11, but having to remember an 11 digit number isn't that bad. It's no longer than a phone number with area and country code. Having to write my student number on every assignment, and test helped me remember my student number quite quickly. Although I could see them needing the social security number for tax purposes as tuition fees are tax deductible, at least in Canada.

Re:

[legoburner]

When I was an international student at a US university, we were given university-issued SSNs before we got official temporary ones from the government. The university did not map between the two and we only had the non-official one associated with our accounts, which was basically an institution ID number, a student ID number and a lot of 'X' characters. There must be a provision at most universities to allow this already, so it would hopefully not be a huge leap to adjust their systems accordingly? As a no

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[Chanc_Gorkon]

SSN's required for Financial Aid and I think Selective Service registration proof is done the same way. Since school is so damn expensive, almost everyoen needs financial aid unless your Bill Gates or at the very least a millionare.

Re:

[Chanc_Gorkon]

So that Big Ten school is OSU....ha ha.

Re:

[another_fanboy]

random number as my student ID rather than my social security number
Many schools now are using ids rather than social security numbers. They are not random, but sequential in order of admittance to the school. As I recall, I had to use my social security number only once, and that was as validation for my student id.

Re:

[trentblase]

They are not random, but sequential in order of admittance to the school.

These people looked deep within my soul and assigned me a number based on the order in which I joined.

Re:

[i.r.id10t]

I remember hearing that the soc. security number is(was? pre 9/11) only required for social security and tax purposes.

From the beginning actually. Cards say on 'em "Not to be used for ID" or something like that. However, it has always been a "mostly" unique number, so someone somewhere decided to start using it as a unique identifier in their database (or rolodex at that point most likely) and its just gotten worse since...

Re:

[hitchhikerjim]

When I was at UCLA in the '80s, they had already long since stopped using the SSN as any sort of student ID number. It was already understood that exposing the SSN had the potential for fraud.

I suspect this database was a finantial one of some sort... one where they actually needed the SSN for its real purpose -- reporting earnings and such to the IRS and the Social Security Administration.

Now why they still retain that information for people who've been out of the system for years is beyond me. That'll pro

Re:

[silentbozo]

UCLA actually had a separate student/employee ID. You'd use this number instead of social security.

Given this practice, it boggles the mind that there was a table left unguarded somewhere that had the actual SSNs. I'm thinking financial aid is the culprit here (since all the load papers demand your SSN). Either that, or admissions, since that would be pre-issuance of your UCLA ID.

What was the hack?

[PhrostyMcByte]

TFA doesn't mention what the "hack" was. My guess, the software (probably a website) is more of a hack than anything that was done to access the data.

It's scary how much information is being reported as leaked every couple months.

Re:

[SNR monkey]

Actually, I think the scary thing is how much information is NOT reported as 'leaked'. As much as it sucks for those 800,000 people, at least they know that there is a good chance their data was compromised. For the rest of us, we have to hope that companies will keep it secure or tell us if it is compromised. You don't have to be wearing a tinfoil hat to worry about the security of your data. Maybe people should be operating under their assumption that their data IS compromised. There are free credit

Santa Claus says "security? ho ho ho!"

[Toby The Economist]

Security is hard to get right because you have to get *everything* right.

Make one mistake and you've got no security.

As such, it is problematic to have vast databases of highly valuable information protected by "security".

The result will be a constant flow of database violations.

Unfortunately, by and large, the a database provides a large and ongoing bureaucratic benefit to an organisation, whereas the pain of data loss is primarily born by the people described by the database.

The only response we have as individuals is to keep our details as secret as possible.

It's difficult because it is "virtual".

[khasim]

Security is hard to get right because you have to get *everything* right.

Sort of. The problem with getting everything right is that you're dealing with non-physical concepts. If people were dealing with a physical structure it would be easier for them to understand and get it "right". Or at least closer to "right" than we currently see.

For example, important physical records are kept in a safe. The safe is in someone's office. The office is locked. If someone sees someone else going through the safe, most o

Re:

[Beryllium Sphere(tm)]

>Imagine organized crime with a database on you similar to what the major credit tracking sites have.

It would be easy for them. How much does a "market research" firm cost to buy outright? How much money could a big crime syndicate muster?

Reminds me of Bruce Schneier talking to Verisign about how much it woulc cost an attacker to compromise their ultimate root certificate. If all else failed, they figured that a $15 million down payment would swig a leveraged buyout of Verisign.

Far, far less.

[khasim]

If all else failed, they figured that a $15 million down payment would swig a leveraged buyout of Verisign.

...and...

It would be easy for them. How much does a "market research" firm cost to buy outright? How much money could a big crime syndicate muster?

Why spend that much money on something you can get for a few thousand in gambling debt or drugs?

You don't have to own the company if you can pwn an employee with the right kind of access.

And the payoff would be millions of times greater than that "investmen

Re:

[canuck57]

Security is hard to get right because you have to get *everything* right.

You are assuming rational due diligence was in fact even attempted. These are institutions run by politicians.

Make one mistake and you've got no security.

Not if you have really done your homework. You NEVER rely on one system. When the second system catches a violation, you promptly deal with it.

One has to ask, why did it take so long to notice? Think about all the others that are not even watching?

Computer security is all abo

Re:

[Phishcast]

Security is hard to get right because you have to get *everything* right. Make one mistake and you've got no security.

I don't agree. Isn't one of the basic principles of security to use multiple layers? Firewall, IDS, TCP wrappers, strong passwords, etc. Insert various other security methods anywhere in the chain and you can be well defended. If I make a mistake in my firewall config, I should still be reasonably sure that I won't be totally compromised.

Re:

[Beryllium Sphere(tm)]

>Security is hard to get right because you have to get *everything* right.

>Make one mistake and you've got no security.

We're used to thinking that because good security design is so rare. Imagine if all ships and boats were guaranteed to sink the instant a hole opened in the hull. Good design contains failures. Maybe, just maybe, UCLA's database had a view that left out the SSNs and that almost all users were required to use. Anyone seriously think they did it that way? Not to mention how long it too

Good Target

[GreggBz]

I imagine a University is the type of organization that kind of flies under the radar. Banks, hospitals, credit card companies, these are obvious repositories of personal information. UCLA, not so much. Factor that in with a large, old, complex computer network with volumes of historical data (Those of you that graduated 20 years ago can probably still get your transcript) and you are bound to have quite a bit of low hanging fruit.

Re:

[Chanc_Gorkon]

Actually, universities have tons of data. Remember how you paid for school right? Financial Aid, Stafford Loans and more and you probably went right through the school to get it thanks to the grade requirements and more. Universities are famous for having alot of things on file and tons of unskilled labor who don't know any better (students and more).

It's time to make the SSN database public

[MightyYar]

If the SSN database were public, the SSN would cease to become such a valuable target for identity thieves - systems would have to be changed to account for the public nature of the information. The SSN is fine as a unique identifier, but it should never have become a security tool.

Re:It's time to make the SSN database public

[Chanc_Gorkon]

The SSN was never to be used as a identifier. PERIOD. It was only to be used for the Social Security System. It was banks and credit bureaus who made the SSN a identifier. The issue that the banks and credit bureaus confronted so many years ago was that they needed a unique way of identifying you for purposes of granting credit. The SSN was the only option as it was desgined from the get go to give you a unique number. Even now though, older SSN's are being reissued as people die off. The problem now is that the number is shown being used by a dead person.

Unfortunately, there's no easy answer. SSN's already in use as an id and until something else better comes along, we have to use it. So what should we in IT do? First, reduce easy access to the number. When designing systems, issue a id that is unique and ONLY works with your system. If you need a way of identifying people in the real world, file the SSN and then reduce access to it. Only let the people who need that number have access to it. In the case of colleges, only financial aid and possibly select people records and registration need to see it. Everyone else MUST use the institution specific id.

The big issue for some higher ed systems is that they used some unsecure methods for far too long. One system in particular up until about 2-3 years ago was using telnet in their client! It was not even SSL'd!

Re:

[Cro Magnon]

IMHO, the big problem is that the SSN is not only treated as an ID, but also as a PASSWORD!!! It would be like me using "Cro Magnon" as my password, and wondering how my /. account got hacked! *runs off to change password*

Re:

[jimstapleton]

Personally, I wouldn't mind seeing fingerprints, DNA or Retina Scan based systems.

Re:

[swillden]

Personally, I wouldn't mind seeing fingerprints, DNA or Retina Scan based systems.

If you think getting your compromised social security number changed is hard, you should see what it takes to change your retinas. Or DNA...

Biometrics are useful security tools, but you have to keep in mind that they are only passwords. They're convenient passwords, in that you can't forget them (though you *can* lose them!), and they're fairly high-entropy passwords as well, making them hard to guess. However, they're unchangeable passwords, and you leave copies of your fingerprints and DNA pretty w

Re:

[turbidostato]

"Because of all of these problems, biometrics should only be used in two scenarios"

What about the old addaggio? "Something you have, something you know, something you are". This triplet is equally valid for low, mid and high level security. It doesn't seem so hard to get even within a PHB skull. Then, why things are *so* badly broken by design? (remember the article: there were a *single* hole within a *single* app, and somebody got *full* access to a mid privacy level database. Multilayer security some

Re:

[swillden]

What about the old addaggio? "Something you have, something you know, something you are". This triplet is equally valid for low, mid and high level security.

It's valid for all environments, but it's too inconvenient and too costly for most. If you can justify the cost, and if you can implement it so that it's convenient enough that the users won't just find ways to avoid it, then by all means do it.

Re:

[swillden]

Well, some are worse than others. Optical fingerprint scanners are among the easiest to fool.

Re:

[Politburo]

Even now though, older SSN's are being reissued as people die off.

Myth. SSA site [ssa.gov] (link may not work due to silly session cookies)

We do not reassign a Social Security number (SSN) after the number holder's death. Even though we have issued over 420 million SSNs so far, and we assign about 5 and one-half million new numbers a year, the current numbering system will provide us with enough new numbers for several generations into the future with no changes in the numbering system.

Re:

[Chanc_Gorkon]

Do you believe them?? I don't. Yes there's the death index but this only counts IF the family accepts the death benefit from the SSA. Plus most credit agencies do NOT and probably cannot do a back check with the SSA to make sure that your name is attached with your number. Therefore, anyone can use your number with a different name and be able to establish an identity. Also, as the populous grows, they will run out of numbers at some point. The running out of number thing happened in most areas with p

Re:

[Vreejack]

The military has used SSN's as a service number almost from the outset, and we actually used to use ours in our mailing addresses. It made delivering mail to highly mobile service members a lot easier. This practice was discouraged in the late 1980's, but as late as the late 1990's the list of US military officers and their SSN's was annually published by congress.

Although the original legislation for SSN's states that it is not meant to be a sort of national identification number, this seems mainly aimed

Re:

[Chanc_Gorkon]

Only some Evangelical's believe this. Some believe in the literal sense of the bible. The mark is the number 666 on the forehead....not SSN's or Credit Card numbers or anything else. The LITERAL meaning. Anything else, to me, is a misinterpretation of the scripture.

Actually, all UPC barcodes contain 666 already

[PRMan]

Decode the bars and you'll find that it's true.

So, if you barcoded my SSN and forced me to wear it on my hand or forehead... Bingo, 2000-year-old prophecy fulfilled!

Re:

[turbidostato]

"Unfortunately, there's no easy answer."

Can you explain then, please, how is it that this kind of problem is *exclusive* to the USA in the whole world?

Can you please explain me how all european countries (to name some you might find liminary civilized) have no problems *at all* with your "dificult to manage" unique-ID issue?

Re:

[Cro Magnon]

"It's time to make the SSN database public"

I thought it already was!

Students?

[Lord_Dweomer]

What sort of options do the students have at this point? Is the school in any way liable? Or is this just going to be one of those instances where they say "oops, we were hacked, so sorry but nothing we can do" and leave the students screwed (once again)?

All I know is that the school better not be heavily promoting its computer security courses.

Re:

[LouisJBouchard]

No one has the right to sue unless an actual crime against the student took place. My SSN was possible stolen from a new employee state database recently (used to determine if someone owes child support they are skipping out on) and the attitude was that since the information was not used yet, we were on our own to protect ourselves. The police even refused to take a report because as far as they were concerned, the only victim was the state agency (never mind the cost and effort I had to go through to prot

IT budget for next year...

[theworldisflat]

They should really think about a better firewall for their Gibson.

The scary thing..

[bigattichouse]

Isn't what people get out of such a breach, but what can be PUT IN.
ohh.. look at Johnny's sparkly new Ph.d. or M.D.

imdemnification against data breach ..

[rs232]

What imdemnification did the software developers provide in the event of such an occurance.

at first glance

[clamantis]

At first glance, I thought the headline read ACLU. Now that would have stirred up a hornets' nest!

Re:

[Stonent1]

Myself as well. I chuckled at first and then reread it and was disappointed.

As an alumnus...

[Otter]

...I'm willing to cut them a lot of slack since the USC game. So let's call this one a wash. Go Bruins!

Telling quote...

[Anonymous Coward]

Jim Davis, UCLA's chief information officer, said a computer trespasser used a program designed to exploit an undetected software flaw to bypass all security measures and gain access to the restricted database that contains information on about 800,000 current and former students, faculty and staff, as well as some student applicants and parents of students or applicants who applied for financial aid.

So, a single software flaw got them past "all security measures." Sounds like some heads need to roll, s

since, from

[minus_273]

"The data may have been available to hackers since October 2005 until November 21, 2006,"

Am I the only one who cringes when he reads this sentence.

Better off?

[FibreOptix]

If the SSN's are now being flagged as compromised and watched for suspicious activity, perhaps the owners are better protected against fraud than they would have been otherwise.

lucky me

[purplelocust]

I seem to be a magnet for large-scale computer identity data leakage. I'm not sure my overall percentage, but I managed to be in a big New York Times subscriber theft a few years ago, the American Express Financial Advisors theft last year, a T-Mobile one, and as a UCLA alum I get this one also. It seemed like everyone who has my name is volunteering it to intruders, and until I looked at this very long list of data loss incidents [attrition.org] I was thinking it might just be me. At least I missed out on the big Veter

Re:

[juggledean]

who knows what the future holds?

Extrapolating from the data in the link above there will be many more incidents in the future, perhaps 600 next year.

Re:

[Wanado]

Nothing bad has come of it as far as I can tell

Your SSN is probably already being used by an entire family of illegal aliens to get work and have accounts. Credit Bureaus, banks, credit card companies, employers, even the IRS aren't obligated to tell you when someone else is using your SSN without your permission. Investigations have found that some SSN's are used by up to 30 people. This stuff doesn't show up on your credit report. Some day you'll get some collections agency looking for money you owe

And then...

[danpsmith]

...corporate types wonder why there are so many lawsuits. To effectively drop the ball on the security of almost a million students and then what you get as far as service is a letter saying "oops," it makes me glad that Bush couldn't get his "frivolous lawsuit" legislation through.

Maybe when companies/organizations trusted with information that leak it start getting sued by the people they are "protecting."

At my school they used the last 4 numbers of your social security number as part of your email. Org

suits over this would not be categorized

[Shivetya]

as frivolous. Most frivolous lawsuits are created without the intent to win but instead to settle.

This incident is negilgent, possibly bordering unto criminal if they can figure out if some people knew about it earlier. Seeing that their a school I wonder what their liability is? I didn't check but is UCLA still considered a government entity? If so they may be already protected by law. Lots of laws that come along that punish businesses purposely exclude government agencies from the very same.

what worries me is...

[jimstapleton]

what if they took the people who's information they obtained, and then dropped it from the server.

For eaxmple - they only went after applicants, collected the information, and dropped it from the server. There would be no existing student/faculty to wonder why there data was missing, and on top of that, if they did it at the right time, there might not even be a backup to verify it was ever there. Thus, the victim gets no warning whatsoever, and the thief gets an even longer time to escape.

I hope the invest

Actually...

[PRMan]

Having worked as the IT person in charge of a University database...

1. Admissions would notice that online records corresponding to the paper files for their applicants kept disappearing from the system.
2. The applicant would call back and nobody would be able to find them.
3. People would begin to notice larger-than-normal gaps in the numbering system.

...and that's just off the top of my head.

Re:

[jimstapleton]

That's a relief. It looks like it affected more of UC than LA was affected by the system incursion, and I applied to UCSD during that time frame. Although SD wasn't one of the mentioned groups, I worried it might be possible. No letter was given to me, so needless to say, I thought it a valid concern.

They call this a "data Valdez."

[MoNickels]

Definition of data Valdez [doubletongued.org], via a self-link.

Maybe actual fraud will end up fixing this?

[King_TJ]

Despite all of these large, high-profile security breaches of late, you don't hear a whole lot about people who actually became victims of fraud right afterwards. I'm sure it's happening, but it seems to be in the "best interest" of practically everyone EXCEPT the consumers owning the info to sweep it under the rug. (EG. "No problem sir! Just mail back the form we send you, detailing all the charges you didn't actually make on your VISA, and we'll take care of it. A new card is on its way out to you right away.")

You'd think that at some point, just about everyone in the U.S. will need to put "fraud alerts" on their credit profiles!

As bad as it sounds, I think it's going to take real financial losses of an almost unmanageable sort for the lenders and credit agencies to say "Enough!" and find new ways to protect consumer info.

Call me the devil but...

[hesaigo999ca]

I think that a better security system would be to have one repository for such information something that is associated by a third party answering to the government as we know the government itself is never capable of establishing ground breaking development, always comes from outsourced work. Once this repository is created, then we could implement a security feature that anyone needing such information would have access to that persons associated record number, if they pass clearance, then based on the l

pwned (tagging beta)

[Dan Slotman]

pwned (tagging beta)

This represents everything wrong with slashdot. On the other hand, I'm still here...

Incompetent Academics

[toddhisattva]

Incompetent Academics
Always Blaming Hackers
To Cover Their Asses!

Re:

[benicillin]

At first I thought that may be a Haiku and I was excited... you let me down

Therefore, I've decided to fix it:

Dumb Academics Constantly Blaming Hackers To Cover Their Ass!

For gov't use only

[berapp]

What happened to the days when your SSN for for government use only. I wasn't around when the SSN was first used, but I heard that is was sold the the American people as a number that only the government would be able to use. In fact, I've been told that it was illegal for non-government agencies to use it at all, or even request it. What happened to those laws? If this is such an important number, why is it so easy to get from someone? I know I've placed mine on many forms I've filled out. Forms for

Their hotline database is offline

[rbanzai]

I went to UCLA in the 80s/90s and have called twice this morning and both times their hotline database was offline. Of course they say "uh, I think... yeah, the database is being updated, please call back in 10-15 minutes..." but when I worked at a call center "database is being updated" = "BROKEN!"

Re:

[rbanzai]

I was in the database.

Idiots.

And this happens the same week a mortgage company lost my parents's financial info for their home loan.

Today's Private info loss

[Md525]

It is so depressing and scary to see these types of stories popping up everyday. I mean this exploit was running for over a year before it was discovered. Every time I read one of these stories I undoubtedly hear the same line or two that provides me with little to know condolence; It doesn't appear the information was misused or there is no reason to believe there is intent to use any of the information. At least in this case UCLA did not do something that drastically contributed to loss of the informat

Same Thing, Different Place

[cellojoe]

As I'm reading this article, I receive an email that tells me that the same thing happened to "Approximately 5,000 students, faculty, and staff at the University of Texas at Dallas". Why does this keep happening? Schools need to be more careful with information they demand from students, and students need to be more reactive when something like this happens. We trust the school with "names, addresses, Social Security numbers, email addresses and telephone numbers" whether we like it or not. So when somethi

I want the real story

[Dunkirk]

What was the actual problem? Bad software, bad configuration, bad programming, bad security practice, just a clever hacker?

Yes, I'm hoping it was a Microsoft shop, top-to-bottom. 8-)

Approaching the breaking-point?

[Zaphod2016]

So another 800,000 SSN's have been leaked into the gooey ether, with the typical "whoops!" form letter in tow. This has started to happen so often that I'm not the least bit suprised.

Am I a cynic, or are we approaching the breaking-point?

At last count, we had 300,000,000 Americans roaming about. Let us assume that 100% of these people were issued SSN's (wrong thread for an illegal immigration debate). 800k out of 300,000k is 0.26%. In other words, this single incident has compromised AT LEAST 0.26% of

It's simple...

[samj]

The best way to protect data is not to collect it in the first place.

Re:This says it all - The rest of the story (tm)

[DenDude]

Yeah, the server that you mention may be 2003, but all of the other servers on netcraft show linux/apache. http://toolbar.netcraft.com/site_report?url=http:/ /www.ucla.edu [netcraft.com]

Re:Universities shoud allow CS departments more sa

[diabolus_in_america]

You must consider, though, that at many schools, the CS department would not repsond to a request from the IT department for any sort of consultation. I am certainly not painting all faculty with the same brush; however, many of them hold tighter to their "job descriptions" than those parodies of union workers on Futurama. They teach, and they publish. Don't ask them to participate in anything outside of those two primary activities.
Granted, there are many college IT shops who would never make the call to t