UVSC data compromised

OREM — Utah Valley State College administrators on Tuesday mailed letters to about 15,000 people, informing them that their Social Security numbers were available online for about a month.

UVSC officials said the information was snagged by the Yahoo Inc. search engine and was available from Nov. 2 to Dec. 12.

The 15,000 people either taught or took distance-education classes at UVSC between January 2002 and January 2005.

UVSC spokesman Chris Taylor said the school believes that few people were able to obtain the Social Security numbers. Officials have not had any reports of anyone trying to use them illegally, he said.

UVSC has four types of distance-education courses: Internet, television, DVD and VHS, and "live interactive," such as those offered via satellite.

Students who have not taken distance-education classes or who took them at another time are not affected, Taylor said.

Also, Social Security numbers of some students and teachers from the three-year time period were not posted on Yahoo!

Taylor declined to release details about how Yahoo! obtained the information from UVSC, saying it would reveal electronic security secrets kept by UVSC and other colleges and universities.

Taylor said Yahoo! has technology that periodically does searches "on your (Web server), on our (server), on everybody's (server) and picks everything up," Taylor said.

"What we're told is that Yahoo! has technology" that other search engines do not employ "and that's how they were able to pick up this data," he said.

On Dec. 5, a student discovered the Social Security numbers.

"We immediately contacted Yahoo! and they were somewhat slow to respond; and as a result, the data remained accessible for an additional week, through (Dec. 12) approximately," Taylor said.

The Deseret Morning News e-mailed questions to a Yahoo! spokeswoman but did not immediately receive a response. No phone number was available.

UVSC delayed mailing the letters for more than 10 days.

"For one, we wanted to make sure this information wasn't anywhere else," Taylor said. "And then, No. 2, it took a little bit of time to identify all the students affected. As soon as we had that nailed down, it coincided with Christmas, but we made sure we went ahead."

The letter urges the recipients to monitor bank and credit card accounts, request and thoroughly review a copy of their credit report and place a fraud alert on their credit if necessary, Taylor said.

UVSC has not identified students by Social Security numbers since 2005. Students are instead issued student ID numbers The school also last year hired a full-time electronic security officer to monitor data, Taylor said.

---

E-mail: lhancock@desnews.com