Stolen laptop teaches Stanford a lesson on need for encryption
AT&T, New Mexico state agency, also fall victim to laptop theft
Computerworld - From the "Why aren't these systems encrypted already?" department comes yet another story of a laptop theft resulting in the potential compromise of personal data belonging to a large number of people.
This time, the victim is Stanford University, which on Friday issued an alert notifying its community of a laptop theft that puts about 72,000 faculty members, staffers and students at risk of identity theft. The theft affects people who have been employed with the university in any way before September 2007.
The stolen laptop contained the names, addresses, Social Security numbers, birth dates, university ID and employee numbers, as well as salary information, Stanford said in a statement posted on its Web site.
As has become typical with such announcements, a university official sought to downplay concerns by expressing doubt that the laptop had been stolen for its data. "We believe that the perpetrator of the crime was not seeking the records on the computer or even aware of them," said Randy Livingston, the university's chief financial officer, in a statement. In most such thefts, the hard drives are erased before the laptop is resold, he added.
It was not immediately clear from the statement if the laptop owner was authorized to store the data on the laptop in the first place. But a comment from Livingston about the need for the university to review its guidelines for storing sensitive information made it appear that the data on the stolen laptop had not been encrypted. An FAQ attached to the statement did not offer any details on whether the data had been encrypted, citing an ongoing investigation by law enforcement.
The university's loss continues a long and growing list of data compromises resulting from lost or stolen laptops. In almost all cases, the organizations that lost the equipment had not encrypted the data, despite the longstanding advice from analysts on the need for it.
The Breach Blog, which maintains a list of recent data compromises, listed two other incidents disclosed last week. One breach involved a stolen laptop containing salary data on an unknown number of management staffers at AT&T Inc., while the other involved a laptop belonging to the New Mexico Department of Workplace Solutions. In both incidents, the contents of the laptops were unencrypted.
This is the second time in less than a year that AT&T has suffered a laptop theft involving the loss of sensitive data. Last August, the company disclosed that a laptop containing unencrypted personal data on current and former employees of the former AT&T Corp. was stolen from the car of an employee of a professional services firm doing work for the company. That theft prompted the company to notify an unspecified number of individuals about the potential compromise of their Social Security numbers, names and other personal details. The theft affected only AT&T employees who were at the company before it was acquired by SBC Communications Inc.
Correction: This story has been changed since it was originally posted to say that the laptop theft affects faculty, staff and students who were employed at the university before September 2007.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts