Stolen laptop teaches Stanford a lesson on need for encryption
AT&T, New Mexico state agency, also fall victim to laptop theft
Computerworld - From the "Why aren't these systems encrypted already?" department comes yet another story of a laptop theft resulting in the potential compromise of personal data belonging to a large number of people.
This time, the victim is Stanford University, which on Friday issued an alert notifying its community of a laptop theft that puts about 72,000 faculty members, staffers and students at risk of identity theft. The theft affects people who have been employed with the university in any way before September 2007.
The stolen laptop contained the names, addresses, Social Security numbers, birth dates, university ID and employee numbers, as well as salary information, Stanford said in a statement posted on its Web site.
As has become typical with such announcements, a university official sought to downplay concerns by expressing doubt that the laptop had been stolen for its data. "We believe that the perpetrator of the crime was not seeking the records on the computer or even aware of them," said Randy Livingston, the university's chief financial officer, in a statement. In most such thefts, the hard drives are erased before the laptop is resold, he added.
It was not immediately clear from the statement if the laptop owner was authorized to store the data on the laptop in the first place. But a comment from Livingston about the need for the university to review its guidelines for storing sensitive information made it appear that the data on the stolen laptop had not been encrypted. An FAQ attached to the statement did not offer any details on whether the data had been encrypted, citing an ongoing investigation by law enforcement.
The university's loss continues a long and growing list of data compromises resulting from lost or stolen laptops. In almost all cases, the organizations that lost the equipment had not encrypted the data, despite the longstanding advice from analysts on the need for it.
The Breach Blog, which maintains a list of recent data compromises, listed two other incidents disclosed last week. One breach involved a stolen laptop containing salary data on an unknown number of management staffers at AT&T Inc., while the other involved a laptop belonging to the New Mexico Department of Workplace Solutions. In both incidents, the contents of the laptops were unencrypted.
This is the second time in less than a year that AT&T has suffered a laptop theft involving the loss of sensitive data. Last August, the company disclosed that a laptop containing unencrypted personal data on current and former employees of the former AT&T Corp. was stolen from the car of an employee of a professional services firm doing work for the company. That theft prompted the company to notify an unspecified number of individuals about the potential compromise of their Social Security numbers, names and other personal details. The theft affected only AT&T employees who were at the company before it was acquired by SBC Communications Inc.
Correction: This story has been changed since it was originally posted to say that the laptop theft affects faculty, staff and students who were employed at the university before September 2007.
Read more about Security in Computerworld's Security Topic Center.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!