bbtitle]
» CC HOME » FORUM HOME

Go Back   College Confidential > College Admissions and Search > Colleges and Universities > CC Top Universities > University of California - Berkeley
New User

Welcome to College Confidential, the leading college-bound community on the Web!
 
Here you'll find hundreds of pages of articles about choosing a college, getting into the college you want, how to pay for it, and much more. You'll also find the Web's busiest discussion community related to college admissions, and our College Visits section!

You are currently viewing the site as a guest.
Registration is simple and easy, and provides full site access.

Join our FREE community:

  • Post and reply to topics
  • Talk privately with other members
  • Participate in polls
  • View less ads
  • Remove this welcome message

 REGISTER NOW

Discussion Menu
»Discussion Home
»Help & Rules
»Latest Posts
»NEW! College Visits
»NEW! Stats Profiles
Top Forums
»College Search
»College Admissions
»Financial Aid
»SAT/ACT
»Parents
»Colleges
»Ivy League
Main CC Site
»College Confidential
»College Search
»College Admissions
»Paying for College
Sponsors
CC Resources for University of California-Berkeley
Reply
 
Thread Tools
Old 05-08-2009, 03:00 PM   #1
Senior Member
 
Join Date: Aug 2008
Posts: 1,985
UC Berkeley hacking leaves 160,000 at risk of ID theft

UC hacking leaves 160,000 at risk of ID theft

"Overseas hackers may have stolen confidential information belonging to tens of thousands of students and alumni at UC Berkeley and Mills College after gaining access to computer databases at the Berkeley campus' health services center, officials said today.

The databases contained Social Security numbers, health-insurance information and non-treatment medical information, such as immunization records and names of some of the doctors that people may have seen and dates of medical visits, said campus spokeswoman Janet Gilmore.

The hackers had access to the information for six months before they were discovered. The breach exposed 160,000 people to possible identity theft, Gilmore said. The university is contacting potential victims, who should consider placing a fraud alert on their credit reporting accounts, she said.
Among those at risk are 3,400 students at Mills College in Oakland who received, or were eligible to receive, health care at UC Berkeley.

Hackers had access to records of students and alumni at UC Berkeley dating back to 1999 and current and former Mills students going back to 2001. Spouses and parents are also vulnerable if they were linked to students' insurance coverage.

The hackers had access to the computer system from last Oct. 9 until April 9, when administrators performing routine maintenance discovered messages they had left, UC said.

Investigators suspect that the overseas hackers accessed a public Web site and then bypassed additional secured databases stored on the same server, Gilmore said. Officials did not say in which country the hackers were based.

UC has notified the FBI about the security breach.

"The university deeply regrets exposing our students and the Mills community to potential identity theft," said Shelton Waggener, UC Berkeley's associate vice chancellor for information technology and its chief information officer. "We are working closely with law enforcement and information security experts to identify the specific causes that may have contributed to this breach and to implement recommendations that will reduce our exposure to future attacks."

University officials stressed that hackers had not obtained medical records - including diagnoses, treatments and therapies - because they are stored in a separate system. However, some students who participated in UC Berkeley's Education Abroad Program may have had their self-reported health records stolen, Gilmore said.

The campus is sending out e-mails and letters today to potential victims of the latest attack. People with questions can call a hot line, (888) 729-3301.
The incident is the latest security breach at UC Berkeley, which has been victimized by hackers in previous high-profile incidents.

In 2005, someone stole a laptop computer containing Social Security numbers of more than 98,000 graduate students, graduate school applicants and other individuals.

In 1998, a high-tech intruder broke into computer accounts at UC Berkeley and other places around the world, decoding nearly 48,000 passwords in what experts then said was one of the largest known collections of stolen access codes.
nooob is offline   Reply   
Old 05-08-2009, 03:16 PM   #2
Senior Member
 
Join Date: May 2006
Location: Berkeley
Posts: 4,032
i got that email too...
what are we suppose to do..?
88888888 is offline   Reply   
Old 05-08-2009, 03:17 PM   #3
Member
 
Join Date: Jul 2007
Posts: 358
Did you get the general email or the specific one? If YOUR data was stolen, they send a message telling you and specifying what steps you can take. Here is a snippet of what they said in their specific email:

Quote:
Protecting Your Personal Information

Attached to this letter is a resource sheet to assist you with steps
that you may wish to take to protect your identity and credit. As a
precautionary measure, we urge you to create immediately a no-cost,
formal fraud alert on your consumer credit file. If someone attempts
to open a new credit card account in your name, this service will
monitor activity on your account.

We have also established a Data Theft Hotline, 888-729-3301. Trained
personnel will be available 24 hours a day, 7 days a week to help you
determine the full extent of your personal exposure and assist you
with information about credit and identity protection services. When
you call, you will be asked to provide personal information to
validate your identity.

Additional information can also be found on our dedicated web site:
Data theft: UC Berkeley
Christopher546 is offline   Reply   
Old 05-08-2009, 03:19 PM   #4
Senior Member
 
Join Date: May 2006
Location: Berkeley
Posts: 4,032
i think i got the general email..

Dear Associate of UC Berkeley,

We are writing to you because UC Berkeley`s University Health
Services, UHS, recently learned that criminal computer hackers broke
into electronic databases containing personal information belonging to
some UHS clients and their parents or spouses.

Although the investigation is still underway, we wanted to alert you
as soon as possible that some of your personal information, including
your Social Security number stored on those databases, was stolen,
which puts you at risk for identity theft. It is also possible that
your parents or guardian or spouse`s information was taken if you
waived enrollment in the Student Health Insurance Plan, and they were
the policy holder of your health coverage.

In addition, the criminals may have stolen information related to your
health insurance coverage and some of your non-treatment medical
information such as Hepatitis B immunization history, UHS medical
record number, dates of visits or names of providers seen, or for
participants in the Education Abroad Program, certain information from
the self-reported health history. You will receive a second
notification letter from us if, in addition to your Social Security
number, this information was also stolen.

Please be assured that UHS electronic medical records, including
patient diagnoses, treatments and therapies, are stored in a separate
system and were not affected in this incident.

We sincerely regret and apologize for any difficulty that this theft
may create for you. We have alerted campus police detectives and the
FBI, and we are doing all that we can to investigate this crime. We
are also dedicated to assisting you with information about the
incident and services that can help prevent or minimize the impact
this theft may have on you.

Protecting Your Personal Information

Attached to this letter is a resource sheet to assist you with steps
that you may wish to take to protect your identity and credit. As a
precautionary measure, we urge you to create immediately a no-cost,
formal fraud alert on your consumer credit file. If someone attempts
to open a new credit card account in your name, this service will
monitor activity on your account.

We have also established a Data Theft Hotline, 888-729-3301. Trained
personnel will be available 24 hours a day, 7 days a week to help you
determine the full extent of your personal exposure and assist you
with information about credit and identity protection services. When
you call, you will be asked to provide personal information to
validate your identity.

Additional information can also be found on our dedicated web site:
Data theft: UC Berkeley

Background Information about the Theft

UC Berkeley computer administrators determined on April 21, 2009 that
restricted electronic databases had been illegally accessed by
hackers, and that the data thefts began on October 9, 2008, and
continued until April 6, 2009. All of the exposed databases were
immediately removed from service to make sure that they would be
completely protected from any future attacks. To ensure that we fully
understand the nature of the security breach and to determine the
steps that we can take to minimize the risk of a reoccurrence, the
university has hired an outside auditor, Price Waterhouse Coopers, to
support our ongoing investigation of the incident.

Finally, please be aware that sometimes in these situations, dishonest
people falsely identifying themselves as UC Berkeley representatives
may contact you and offer assistance with the intention of obtaining
more personal information from you. If you call our Data Theft Hotline
the operator will need to ask for information to validate your
identity, but we want to assure you that UC Berkeley will not contact
you by phone, e-mail or any other method to ask you for personal
information. If you are uncertain about any inquiry, please call our
hotline directly.



Sincerely,



Steve Lustig
Associate Vice Chancellor, Health and Human Services

Shelton Waggener
Associate Vice Chancellor & Chief Information Officer




Understanding and Protecting Yourself from Identity Theft

People who have had personal information stolen are at risk if they do
not take steps to protect their identity. According to a Federal Trade
Commission report, most identity theft involves the illegal use of
credit card, bank, utilities, and other existing accounts.
Fortunately, there are steps, described below, that you can take to
protect yourself and your credit. In addition, extensive information
on personal identity theft and fraud and protective steps you can take
is available on the Web site of the California Office of Privacy
Protection, a division of the state Department of Consumer Affairs,
Consumer Privacy - California Office of Information Security and Privacy Protection (OISPP).

PLACING A FRAUD ALERT
By placing a fraud alert on your consumer credit file, you let
creditors know that they should watch for unusual or suspicious
activity in any of your accounts, such as someone trying to open a
credit card account in your name.

To place a free fraud alert, call one of the three major credit
reporting agencies listed below.
Your phone call will take you to an automated phone system. Be sure to
listen carefully to the selections and indicate that you are at risk
for credit fraud. You need only contact one of these agencies, which
will automatically forward the fraud alert to the other two. These
agencies offer the initial fraud alerts at no charge.

Equifax
888-766-0008
Consumer Fraud Division
P.O. Box 740256
Atlanta, GA 30374
Equifax: Credit Reports, Credit Scores, Protection Against Identity Theft
Equifax home page
Equifax Online Help: How to Set a Fraud Alert
Equifax fraud alert information page

Experian
888-397-3742
Credit Fraud Center
P.O. Box 1017
Allen, TX 75013
Credit Report and free credit score at Experian.com
Experian home page
https://www.experian.com/consumer/ca...=SECURITYALERT
Experian credit fraud page
Experian | Consumer Credit Fraud | FAQ
Experian credit fraud FAQ

TransUnion
800-680-7289
Fraud Victim Assistance Department
P.O. Box 6790
Fullerton, CA 92834
TransUnion - Check Your Credit Report and Credit Score Online, Instantly and Securely
TransUnion home page
TransUnion Personal: Fraud Alert
TransUnion fraud page

Soon after you place a fraud alert, you will receive credit reports by
mail from all three reporting agencies. In the credit report, check
your personal information, including home address, Social Security
number, etc., for accuracy. Look for any charges that you did not
make. Watch for any accounts that you did not open. Note any
inquiries from creditors that you did not initiate.

If you find anything that looks suspicious or that you do not
understand, call the credit agency at the telephone number listed on
your credit report. You may also wish to call your local police or
sheriff`s office to file a report of identity theft.

PLACING A SECURITY FREEZE
A security freeze means that your credit file cannot be shared with
potential creditors unless you give your consent. If your credit files
are frozen, even someone who has your name and Social Security number
would probably not be able to obtain credit in your name. If you take
this step any new creditors that request your file from one of the
three credit bureaus will only obtain a message or a code indicating
that the file is frozen. While you will be able to lift the freeze for
legitimate inquiries, you should be aware that this can slow any
credit approval process.

A security freeze is free to those who have a police report of
verified identity theft. To obtain a police report, contact your local
police department. Give the police as much information on the theft as
possible. One way to do this is to provide copies of your credit
reports showing the items related to identity theft. Black out other
items not related to identity theft. Give the police any new evidence
you collect to add to your report. Be sure to obtain a copy of your
police report. You will need to give copies to creditors and the
credit bureaus.

If you do not have a police report, it costs $10 to place a freeze with each
credit bureau, for a total of $30. The credit bureaus require that freeze
requests be made in writing.

Samples of freeze request letters can be found at:
http://www.oispp.ca.gov/consumer_pri...rityfreeze.pdf


Equifax Security Freeze
P.O. Box 105788
Atlanta, GA 30348
Send by certified mail.
Include name, current and former address, Social Security number and
date of birth. Pay by check, money order or credit card, Visa, Master
Card, American Express or Discover only. Give name of credit card,
account number and expiration date.

Experian Security Freeze
P. O. Box 9554
Allen, TX 75013
Send by certified mail.
Include full name, with middle initial and Jr./Sr., etc. Include
current address and home addresses for past five years, Social
Security number, birth date and two proofs of residence, such as a
copy of driver's license, utility bill, insurance statement, bank
statement. Pay by check, money order or credit card. Give name of
credit card, account number and expiration date.

TransUnion Security Freeze
P. O. Box 6790
Fullerton, CA 92834
Send by regular or certified mail.
Include first name, middle initial, last name, Jr./Sr., etc. Current
home address and addresses for past five years, Social Security number
and birth date. Pay by check, money order or credit card. Give name
of credit card, account number and expiration date.

Additional information on how to initiate a Security Freeze can be
found on the Web site of the California Office of Privacy Protection:
http://www.oispp.ca.gov/consumer_pri...rityfreeze.pdf

CREDIT MONITORING
This service will send you e-mail alerts when new accounts, inquiries,
negative information, credit-limit changes, and other items appear on
your credit report. The following firms all offer credit monitoring
services on a monthly basis with prices ranging from $4.95 to $14.95 a
month. Please note that Federal Trade Commission and country`s
leading consumer groups do not endorse this particular service. They
suggest that signing up for a free Fraud Alert and placing a Security
Freeze on your credit file offers a higher level of protection.

Experian: Protect yourself from identity theft with Credit Monitoring from TripleAlert.com
True Credit:
https://www.truecredit.com/products/...e=TriBureauCMU
Identity Guard: Get IDENTITY GUARD Total Protection: Credit, Internet, Computer, On-the-Go
Equifax: Equifax ID Patrol: Identity Theft Protection & Daily Credit Monitoring
88888888 is offline   Reply   
Old 05-08-2009, 03:19 PM   #5
Member
 
Join Date: Mar 2008
Location: Berkeley
Posts: 573
I got the general email just now.
hamburgler2 is offline   Reply   
Old 05-08-2009, 03:21 PM   #6
Senior Member
 
Join Date: May 2006
Location: Berkeley
Posts: 4,032
wait.. is mine the general or.. specific one lol. can't tell
88888888 is offline   Reply   
Old 05-08-2009, 03:22 PM   #7
Member
 
Join Date: Mar 2008
Location: Berkeley
Posts: 573
No, mine only has a short letter from the associate dean. Not all that extra stuff.
hamburgler2 is offline   Reply   
Old 05-08-2009, 03:23 PM   #8
Member
 
Join Date: Mar 2008
Location: Berkeley
Posts: 573
Quote:
Colleagues,
We want to let you know that today the campus is sending notification letters and
emails to members of our community to inform them of a computer breach that resulted
in the theft of personal information from databases in our University Health
Services, UHS, area.

The victims of this crime are current and former students, as well as their parents
and spouses if linked to insurance coverage, who had UHS health care coverage or
received services. We are also sending notification letters to Mills College
students who received, or were eligible to receive, healthcare on the UC Berkeley
campus.

We sincerely regret and apologize for any difficulty this theft may create for
individuals who may have had their personal information exposed. We have alerted
campus police detectives and the FBI, and are doing all that we can to investigate
this crime. All of the exposed databases were immediately removed from service to
make sure that they would be completely protected from any future attacks.

Those individuals directly affected by the theft will receive letters with detailed
information on steps that they can take to protect their credit and identity. We
have launched a dedicated web site, Data theft: UC Berkeley that contains
detailed information for affected individuals, the media and the general public. In
addition a Data Theft Hotline, 888-729-3301 will be operating 24 hours a day, 7 days
a week to answer questions from affected individuals.

UC Berkeley computer administrators determined on April 21 that electronic databases
in UHS had been breached and data stolen by overseas criminals. The databases
stored personally identifiable information used for billing such as Social Security
numbers, and non-treatment medical information such as immunization history, UHS
medical record numbers, dates of visits or names of providers seen, or for
participants in the Education Abroad Program, certain information from the
self-reported health history.

Please be assured that UHS electronic medical records, which include details of
patients diagnoses~, treatments and therapies, are stored in a separate system and
were not affected in this incident.

To ensure that we fully understand the nature of the security breach and to
determine the steps that we can take to minimize the risk of a reoccurrence, the
university has hired an outside auditor, Price Waterhouse Coopers, to support our
ongoing investigation of the incident. The campus is committed to implementing
recommendations that address the root causes of this security breach.

Steve Lustig
Associate Vice Chancellor
Health and Human Services

Shelton Waggener
Associate Vice Chancellor & CIO
Information Services & Technology

^that's the one I got.
hamburgler2 is offline   Reply   
Old 05-08-2009, 03:24 PM   #9
Senior Member
 
Join Date: May 2006
Location: Berkeley
Posts: 4,032
^
yea i got that one.. and the one i posted before ><
88888888 is offline   Reply   
Old 05-08-2009, 03:26 PM   #10
Member
 
Join Date: Jul 2007
Posts: 358
88888888, you got the specific email. Note the beginning of the second paragraph:

Quote:
Although the investigation is still underway, we wanted to alert you
as soon as possible that some of your personal information, including
your Social Security number stored on those databases, was stolen,
which puts you at risk for identity theft.
This is not fun. But at least we are in it together.
Christopher546 is offline   Reply   
Old 05-08-2009, 03:30 PM   #11
Senior Member
 
Join Date: May 2006
Location: Berkeley
Posts: 4,032
eh.. ok thanks off to sproul
88888888 is offline   Reply   
Old 05-08-2009, 03:32 PM   #12
Senior Member
 
Join Date: May 2006
Location: Berkeley
Posts: 4,032
oh.. crap.. no wonder.. my mom said.. some berkeley person called..for my information.. hopefully my mom didn't give it out.. im gonna call her now
88888888 is offline   Reply   
Old 05-08-2009, 04:01 PM   #13
Senior Member
 
Join Date: Aug 2004
Location: Oakland
Posts: 1,769
Yeaaaaah. I got two of those emails. Dangit. :[

At least I just requested a credit report, and it won't be too hard to call in a watch on my SSN. Siiiigh. Happy graduation to me. XD
undecided is offline   Reply   
Old 05-08-2009, 04:03 PM   #14
Junior Member
 
Join Date: Jun 2007
Posts: 132
My roommates and I all got the 2 emails...I just send out an email to my family telling them NOT to give out any info.
green-aw-lives is offline   Reply   
Old 05-08-2009, 04:04 PM   #15
Member
 
Join Date: Mar 2008
Location: Berkeley
Posts: 573
just wondering, but... how the heck does someone get away with this for several months before someone even knew they did it ?? wth...
hamburgler2 is offline   Reply   
Reply

Bookmarks

Thread Tools


Similar Threads
Thread Thread Starter Forum Replies Last Post
Harvard - New Grants for $160,000 Families bandit_TX Parents Forum 0 10-02-2007 09:42 AM
googling A gives 6,660,000,000 result. But googleing B gives 1,800,000,000 results. stuck-on-1700 College Confidential Cafe 16 11-19-2006 06:11 AM
Santa Barbara OKs Housing Aid for Folks Making Up to $160,000 a Year latetoschool Parent Cafe 0 08-15-2006 05:32 AM
Identity Theft Risk? Strick11 Parents Forum 6 08-12-2005 11:05 AM
$160,000 School Decal? uc_benz College Admissions 4 12-18-2004 01:18 AM


All times are GMT -5. The time now is 03:58 PM.


Copyright 2001-2009, Hobsons, Inc., All Rights Reserved