p2pnet - rss feed: UC Berkeley hack apology
p2pnet.net News:- “UC Berkeley officials issued a statement of regret about a computer hacking that may have exposed the names and social security numbers of about 600,000 people,” says the Berkeley Daily Planet.
Personal and confidential information on everyone in California under the state’s In-Home Supportive Services program since 2001 were on a hacked data base.
People involved were advised to contact the major credit reporting agencies to place fraud alerts on their credit profiles, and start monitoring their credit reports for signs of identity theft.
"The database in question contained personal information about people who provide and receive in-home health care, including provider pay," says the Planet, going on:
"UC officials said that a scholar from Connecticut College visiting at UC’s Institute of Industrial Relations was doing statistical analysis of home health care in California, and was accessing the database for her research project. The scholar was trying to determine how wage and benefit increases can improve the recruitment and retention of quality home-care workers.
"As soon as the matter was brought to the attention of the campus counsel he [or she] began to work closely with the appropriate state and federal authorities, including the FBI. Officials from the campus, Department of Social Services, the FBI and officials from Connecticut College met on Sept. 27 to address the security breach.
"Officials believe the security breach was related to linking a non-UC computer and non-UC server to the campus network system without taking proper precautions against intrusion."
===================
See:-
statement of regret - Hacker Exposes UC Private Information, Berkeley Daily Planet, October 22, 2004
confidential information - Huge CA dbase penetration, p2pnet, October 20, 2004
October 24th, 2004 at 8:21 pm
When dealing with confidential data you CANNOT allow anyone access.
You must produce statistics in-house with confidentially-binded personnel.
Then you release only anonymous statistics.
Everyone involved with this breach of security should be held accountable.
There is no excuse for what they allowed to happen.
If they’re not then anytime someone wants confidential information they’ll just arrange a ‘leak’.
And say oops, we’re sorry, it’s not our fault.