CORVALLIS, Ore. — A data security breach has prompted Oregon State University to alert thousands of students and employees that their personal information might not be secure.
Administrators sent out a letter notifying approximately 21,000 current and former students and employees that some of their personal information was copied without permission by a contracted vendor.
The investigation began about three weeks ago after an OSU employee noticed a contracted software vendor used unauthorized data to improve his product for OSU.
“He’d taken that data offsite back to his business in order to use it to make improvements, so the intent was good. He was trying to make his product better for us, but he didn’t trigger the fact that he shouldn’t be taking our data offsite,” said OSU Director of Business Affairs Aaron Howell.
Administrators say the man copied the data without permission three different times between 1996 and 2009.
The data includes names, addresses and Social Security numbers of people who received an emergency student check or payroll draw. Records after 2004 didn’t include social security numbers.
Students say they’re shocked to hear this could happen on campus.
“I feel pretty safe with my information and the school. I definitely have confidence in them, but overall, it is kind of weird that someone got it so easily,” said OSU student Sadie Crocker.
OSU reclaimed the data and severed its contract with the vendor.
Administrators sent out a letter and set up a web site advising those affected to monitor their financial accounts and credit reports.
“The actual risk to individuals is very low. We still want to notify people so that they can take steps that they’re comfortable with to protect themselves and their data,” Howell said.
Corvallis police say taking those steps to protect your identity is always essential.
“The quicker you catch any kind of fraudulent activity, the more likely police are in apprehending the individual involved, as well as more likely that you would get your money reimbursed,” said Capt. Tim Brewer with the Corvallis Police Department.
Oregon State Police are investigating whether or not this was a criminal activity.
OSU is now updating its data security protocol so that vendors agree they understand and will comply with restrictions around OSU data.