Housing SSN security breach

The housing SSN scandal took place in June 2008, when it emerged that a student Housing Services employee had posted a spreadsheet of student SSNs online in February 2007.

Over 5,000 students were sent emails informing them of this confidentiality breach. Some students were offered 2 years of credit monitoring, others were not.

Email offering credit monitoring

(please post)

Alternative email

From: studentservices-assist@columbia.edu
Mailed by: piglet.college.columbia.edu
Date: 11 June 2008
Subject: Important Security Information

On June 3, Columbia University’s Housing and Dining department was informed that one archival database file containing the housing information of approximately 5,000 current and former undergraduate students was found on a Google-hosted website. Google removed this file, at our request, that same day.

Columbia Public Safety investigators have concluded that this security breach was unintentional. No financial data was included in the file in question, and we have no evidence of wrongdoing or identity theft. It appears that the file was inadvertently posted by a former student employee in February 2007. Nevertheless, it is important for you to be aware that your name and Social Security Number were included in the file. We are very sorry for this occurrence.

Information security is a serious issue for us, as we know it is for you. Columbia University is continually strengthening its measures to protect Social Security Numbers where they are required in our systems. Housing & Dining manually eliminated Social Security Numbers from its online room selection process and contracts in April 2007. Further, in spring 2008, Columbia Housing and Dining implemented a new software system to manage and improve the housing assignment, contract, and billing processes which also does not use Social Security Numbers. Unfortunately, this file was uploaded prior to when these changes were made.

As a precaution, we recommend you activate a fraud alert with the major credit bureaus, or periodically request a credit report to look for potential irregularities and ensure that no new accounts have been activated in your name. Each agency has an automated fraud alert process. If you activate a fraud alert, the agency you contact will notify the other two agencies so that those agencies also can place fraud alerts on your accounts. In addition, each agency will provide you a copy of your credit report at no cost. The contact information for the credit agencies is as follows:

Equifax – (800) 525-6285 – www.equifax.com
Experian – (888) 397-3742 – www.experian.com
Trans Union – (800) 680-7289 – www.transunion.com

We sincerely apologize for the inconvenience this has caused you. Please know that we take the protection of your identity seriously. We are confident that the changes we have made since this file was posted have made all students and alumni safer.

If you should have any questions or comments, please contact us by calling 1(888) 882-7331 or by emailing studentservices-assist@columbia.edu .

Sincerely,

Scott Wright
Vice President
Student Auxiliary & Business Services