Stolen UT computer contained sensitive material

A computer with sensitive student and faculty information was stolen from the office of an administrative assistant in University Hall last month.

This week, UT notified the 24,000 students and 450 faculty members whose information was on the computer about the possibility of a breach of their information. The data on the computer contained information from the 2007-08 and 2008-09 academic school years.

The student data on the stolen computer included directory information and educational data such as Rocket Numbers, college and high school GPAs and current GPA.

“From the identity theft stand point, students aren’t really at risk,” said Bob Hogle, director of network services. “We do take very seriously their educational assets, but it is not an identity theft situation.”

While student information could not be used for identity theft, Hogle said faculty information would have greater exposure if the computer was stolen for identity theft purposes.

The faculty information on the stolen computer included personal information such as their names, Social Security numbers and dates of birth, in addition to professional information such as their faculty ranks, departments, degrees, gender, hire dates and the dates of their last promotions.

“First of all, I think that the probability of the data being used or breached on that machine is very low,” Hogle said. “I really believe that the evidence indicates that the intent was to steal a machine that had some value for resale rather than the intent being to steal data.”

If the perpetrator’s intent was to use the sensitive information, Hogle said they probably would have taken the external hard drive that was left on the desk. UT Police Chief Jeff Newton said there were signs of forced entry to the door of the office, and it is believed the perpetrator attempted to gain access to other nearby offices.

“We believe that the target was just the hardware itself, not necessarily what was on the computer, but, again, that’s just what we believe,” he said.

The investigation is still ongoing, and under the direction of John Lautzenheiser, a UT police detective. Newton said UTPD is pursuing several avenues and investigative techniques in hopes of recovering the stolen computer.

“It’s going to be a difficult task, I guess; however, it’s not impossible that at some point this computer is flagged and recovered,” he said.

Hogle said the computer was password protected and many of the individual files containing sensitive information were password protected or encrypted, making it difficult for the perpetrator to compromise the data. After upgrading to the Banner System in the spring of 2008, student Social Security numbers were replaced with Rocket Numbers, Hogle said.

“Since most of the files on this system were from that period of time, student Social Security numbers were not included in any of these files,” he said. “Only their rocket numbers were in use.”

UT faculty and staff are educated on how to properly care for sensitive data and the importance of doing so, Hogle said.

“This user was actually very diligent about how he handled data, but we do believe there were a few files that escaped his diligence,” he said.

According to Hogle, the Information Technology Department at UT will deploy a new tool that will allow them to search the network for sensitive information to determine if is properly secured, if it could be eliminated or if it needs additional security measures.

“We just constantly are looking for where it’s being used, trying to challenge why it needs to be there, eliminate it wherever possible and go out and search wherever it [has] been left behind,” he said.

Hogle said the IT Web site contains information for detecting and preventing identity theft for UT community members.

“You need to be aware, and that’s why we are communicating that information, in case you do see something unusual in your personal records,” Newton said.

2 comments

Your name

Thu Mar 19 2009 15:08

Even if it was the intent of the person to steal just the hardware, hasn't this article and others now alerted the thief to the fact that there is sensitive data on the harddrive that could be used for idenity theft. Hmmm... though informative, sometimes the media increases chances of wrongdoing.

Your name

Thu Mar 19 2009 10:50

Obviously this did not involve all of the A&S faculty (because the number is too low) but what departments were involved and, more importantly, why was this information being stored on that computer to begin with?

Add comment


I am not posting spam. I understand posting spam or other comments that are unrelated to this article will cause my comment to be flagged for deletion and possibly cause my IP address to be permanently banned from this server.

Enter the characters in the image above:

log out