UTSA Honors College informs students of computer security incident

Photo: Freeimages.co.uk

By David Gabler
Associate Vice President for University Communications

(Sept. 22, 2011) -- The University of Texas at San Antonio is informing 688 students and prospective students who either enrolled in or applied to courses in the Honors College that an unauthorized user may have gained access to information about them. Those affected have been notified by personal letter.

During the data exposure, the records of a few UTSA students were accessed by unauthorized users in the Honors College section of the online system. When accessed, these records were pulled into the Honors College section. These students may receive the personal letter if it was possible their records were accessed, even if they were never enrolled in the Honors College.

The data exposure was discovered Aug. 2 and information exposed included name, date of birth, address, phone number, email address, GPA and other personal information. No Social Security numbers were part of the information exposed. Within an hour of discovering the unauthorized access, UTSA officials addressed the issue and initiated an investigation.

Examination of the data exposure indicated its characteristics were not consistent with an attack designed to gather data from the system, but rather an inadvertent misconfiguration of assigned access to the information.

"While we believe the situation has been completely contained, we want to notify each individual directly to make him or her aware of the incident and provide a contact at the university who can provide additional information if needed," said Richard Diem, dean of the UTSA Honors College. "The likelihood that the information was misused is very low, but our primary concerns are informing affected individuals and working to ensure that this never occurs again."

For more information, contact the UTSA Honors College at 210-458-4106.

------------------------------

• How did the data exposure occur?
  On Aug. 2, an employee discovered that the ASAP online information system used by the UTSA Honors College and other UTSA offices was accessible by users who didn't have a business need to access the application. The problem was resolved within an hour of discovery. The exposure was caused by a configuration error implemented June 20, allowing access to ASAP by all UTSA employees with ASAP access, rather than only authorized Honors College users. A thorough analysis and investigation of the incident determined that 233 records were accessed by unauthorized employees and 455 additional records may have been accessed.
• How many students' records were exposed?
  The records of 4,700 individuals who were either qualified for the Honors College or were Honors College alumni were exposed (open to access), but only 688 records were accessed. It was determined that 233 records were accessed by unauthorized users. An additional 455 records may have been accessed by unauthorized users; the remaining 4,012 records were not accessed.
• Who was notified of the data exposure?
  The 688 individuals whose records were accessed or which may have been accessed by unauthorized users were notified via postal mail and email, using contacting information on file.
• I'm part of the Honors College, but I didn't get a communication indicating that my data was exposed. How can I find out if I was affected?
  All students whose records were accessed have been notified separately by both postal mail and e-mail. (See previous question.)
• What could someone potentially do with my exposed information?
  Since the data was exposed to UTSA employees and was not the result of an attack, there is no indication and it is unlikely that exposed data was misused. It is possible someone could use such information to try to obtain more information about you, such as in a "phishing" email claiming to come from UTSA. Date of birth is sometimes used as a question to help validate identity. Social Security numbers, driver's license information and financial account information were not exposed, so the exposed information is highly unlikely to be used for financial identity fraud. Consequently, a security freeze and credit monitoring are not recommended as the result of the data exposure. However, free credit reports can be obtained annually from the three credit bureaus, and periodically reviewing your credit reports is a good way to reduce the risk of financial identity fraud.
• What steps should I take because of the data exposure?
  Log in to ASAP and visit the Honors College form. Check to ensure that all of your information is correct. If the information that was exposed (such as date of birth) is used by you as part of a password or as an answer to a forgotten password question, consider updating that information. If you receive an email that claims it is from UTSA, inspect it to be sure that it is not a phishing email. UTSA will not contact you to ask for personal information such as this. For more information on protection from phishing, visit the UTSA Information Technology website.
• Does UTSA have policies and standards in place to try to prevent data exposure?
  Yes, read the UTSA information resource use and security policy and the UTSA information security standards.
• What steps are being taken as a result of the data exposure?
  The testing process has been revised to ensure that additional testing is performed in order to detect configuration errors before changes are implemented.

UTSA will share more information as it becomes available.