WOSC issues ID alert about computer security incident - February 23rd, 2009
On February 18, 2009, Western Oklahoma State College Information Services received notification from a non-college entity that an attack attempt had originated from a computer within the Western domain. This notification was investigated by WOSC technical staff and it was discovered that a hacking incident had resulted in an unauthorized program, known as a rootkit, being installed on a WOSC server, housed at WOSC but administered by a third party vendor. This server only impacts WOSC library patrons and is separate from other campus servers.
After further investigation it was determined that this server contained personal data for 1,500 individuals that possessed or had been issued library access since Fall 2004. This data was potentially at risk of being compromised by the hacker. The data being maintained for these individuals includes Social Security Number, Name, Mailing Address and Phone Number. Based on file system analysis, there is no indication that any of the data on the machine was actually compromised - only that the opportunity for someone to access it existed.
While we have no indication that any of the information maintained on the server has been compromised we are encouraging members of the college community to monitor financial records over the next several months carefully. You may decide to place a fraud alert with the three national credit reporting agencies. A fraud alert does not affect your credit score or your credit rating. When a fraud alert is placed on your credit report, credit companies should contact you before approving a new application for credit under your name. The three credit reporting agencies are able to respond to your concerns regarding fraud alerts and their impacts. Thanks to a new federal law, consumers can get one free credit report per year from each of the three national credit bureaus: Equifax, Experian,Trans Union and AnnualCreditReport.com.
If, after a review of your credit report, you believe a crime (fraud/identity theft) has been committed against you as a result of this incident, you should report your crime to your local law enforcement agency.
In order to answer any questions that you may have regarding this incident we have created a web site, http://incident.wosc.edu, which will provide additional information and updates regarding this incident. Please call 580 477-7992 or 580 477-7764 if you have additional questions. We will provide additional information to you as it becomes available.
This represents the College’s official notification to you regarding this incident. As a further security measure be advised that the College will not be soliciting further information from you. As always, caution should be taken with regard to any future request made to you regarding your personal information. To ensure timely distribution of this notice, we are also notifying Oklahoman media of this incident.
We regret any inconvenience that this incident may cause and are working hard to ensure that such an incident won’t re-occur. Lastly, please be assured that the security of your educational records remains one of our highest priorities and to that end we will hold all of our technology third party vendors to the strictest standards possible in safe guarding the privacy of student records.
Sincerely,
Kent Brooks
Chief Technology Officer
Western Oklahoma State