UTSA Honors College informs students of computer security incident
(Sept. 22, 2011) -- The University of Texas at San Antonio is informing 688 students and prospective students who either enrolled in or applied to courses in the Honors College that an unauthorized user may have gained access to information about them. Those affected have been notified by personal letter.
During the data exposure, the records of a few UTSA students were accessed by unauthorized users in the Honors College section of the online system. When accessed, these records were pulled into the Honors College section. These students may receive the personal letter if it was possible their records were accessed, even if they were never enrolled in the Honors College.
The data exposure was discovered Aug. 2 and information exposed included name, date of birth, address, phone number, email address, GPA and other personal information. No Social Security numbers were part of the information exposed. Within an hour of discovering the unauthorized access, UTSA officials addressed the issue and initiated an investigation.
Examination of the data exposure indicated its characteristics were not consistent with an attack designed to gather data from the system, but rather an inadvertent misconfiguration of assigned access to the information.
"While we believe the situation has been completely contained, we want to notify each individual directly to make him or her aware of the incident and provide a contact at the university who can provide additional information if needed," said Richard Diem, dean of the UTSA Honors College. "The likelihood that the information was misused is very low, but our primary concerns are informing affected individuals and working to ensure that this never occurs again."
For more information, contact the UTSA Honors College at 210-458-4106.
------------------------------Data Exposure FAQ
- How did the data exposure occur?
On Aug. 2, an employee discovered that the ASAP online information system used by the UTSA Honors College and other UTSA offices was accessible by users who didn't have a business need to access the application. The problem was resolved within an hour of discovery. The exposure was caused by a configuration error implemented June 20, allowing access to ASAP by all UTSA employees with ASAP access, rather than only authorized Honors College users. A thorough analysis and investigation of the incident determined that 233 records were accessed by unauthorized employees and 455 additional records may have been accessed.
- How many students' records were exposed?
The records of 4,700 individuals who were either qualified for the Honors College or were Honors College alumni were exposed (open to access), but only 688 records were accessed. It was determined that 233 records were accessed by unauthorized users. An additional 455 records may have been accessed by unauthorized users; the remaining 4,012 records were not accessed.
- Who was notified of the data exposure?
The 688 individuals whose records were accessed or which may have been accessed by unauthorized users were notified via postal mail and email, using contacting information on file.
- I'm part of the Honors College, but I didn't get a communication indicating that my data was exposed. How can I find out if I was affected?
All students whose records were accessed have been notified separately by both postal mail and e-mail. (See previous question.)
- What could someone potentially do with my exposed information?
Since the data was exposed to UTSA employees and was not the result of an attack, there is no indication and it is unlikely that exposed data was misused. It is possible someone could use such information to try to obtain more information about you, such as in a "phishing" email claiming to come from UTSA. Date of birth is sometimes used as a question to help validate identity. Social Security numbers, driver's license information and financial account information were not exposed, so the exposed information is highly unlikely to be used for financial identity fraud. Consequently, a security freeze and credit monitoring are not recommended as the result of the data exposure. However, free credit reports can be obtained annually from the three credit bureaus, and periodically reviewing your credit reports is a good way to reduce the risk of financial identity fraud.
- What steps should I take because of the data exposure?
Log in to ASAP and visit the Honors College form. Check to ensure that all of your information is correct. If the information that was exposed (such as date of birth) is used by you as part of a password or as an answer to a forgotten password question, consider updating that information. If you receive an email that claims it is from UTSA, inspect it to be sure that it is not a phishing email. UTSA will not contact you to ask for personal information such as this. For more information on protection from phishing, visit the UTSA Information Technology website.
- Does UTSA have policies and standards in place to try to prevent data exposure?
Yes, read the UTSA information resource use and security policy and the UTSA information security standards.
- What steps are being taken as a result of the data exposure?
The testing process has been revised to ensure that additional testing is performed in order to detect configuration errors before changes are implemented.
UTSA will share more information as it becomes available.
UTSAPD and Emergency Management will host a table with safety information, give-a-ways and interactive demonstrations. Both departments will provide information on services available to the UTSA Community.Student Union Window Lounge, 1.02.00C
The Adobe Creative Campus Kickoff will introduce students to Adobe software and how they can use it to both produce professional content for their courses as well as how they can create content for their side hustle. The hour-long session will teach you how to gain FREE access to downloadable software such as Photoshop and Illustrator as well as web-based programs such as Adobe Spark. Want to learn more? Contact William.Schaefer@utsa.edu.Virtual Event
This event has been revised into a two part event. This event will be held virtually while a follow-up event on-campus will be scheduled sometime after Feb. 6th. Please follow our RowdyLink page for information on the next event.Virtual Event
Come and meet your First-Year Experience (FYE) UPM Peer Mentor! As a first-year student at UTSA, you will be meeting with a peer mentor in your Academic Studies area. Your peer mentor is here to support and guide you academically and socially, as you navigate your first year of college. Your UPM Peer Mentor will be emailing you a unique Zoom link to their UPM Meet & Greet!Virtual Event
The UTSA Zoom license will provision your UTSA email account with a Higher ED Pro Zoom account that comes with multiple features. Join us as we review these features. including best practices, for using this software for education and think about the best way to use it in, for, and with our digital classrooms.Virtual Event
A restorative justice virtual conversation to process thoughts and emotions as our community continues to navigate the impacts of Covid-19.Virtual Event
Join us for our Spring 2022 virtual get-together where you can meet the Student Success Team, Faculty, and Peer Mentors in the College for Health, Community and Policy (HCaP). This will be a great opportunity to get connected to the HCaP community and meet other HCaP students. Plus, you get to learn about services offered through the new HCaP Student Success Center.Virtual Event