UCLA Data Breach Puts 800,000 at Risk

As many as 800,000 current and former employees and students of the University of California Los Angeles may be at risk after a hacker gained access to their private information, the school disclosed on Tuesday.

Although there is no evidence that any of the data has actually been misused, the school is taking the indicident seriously. UCLA joins companies like Citigroup, DSW Shoe Warehouse, and ChoicePoint, which have also either lost or had customer data compromised in the last year.

The FBI has stepped in and is conducting an investigation, the school said. From what is currently known, the attacker gained access to the system through the exploit of a flaw in the college's Web site. Accessed were names and social security numbers, although additional personal information was included in the data sets.

UCLA network administrators first noticed the suspicious activity on November 21, and immediate action was taken at that time to block access to the database. It may have been too late, however; an investigation has uncovered that the hacker may have been accessing the database since October 2005.

While the school believes that only a fraction of the 800,000 are at risk, out of caution everyone included in the database was being contacted.

Those affected would be current and some former students, faculty and staff, some student applicants and some parents of students or applicants who applied for financial aid. About 3,200 were employees of either UC Merced or the UC Office of the President, the school said.

"We take our responsibility to safeguard personal information very seriously," Acting Chancellor Norman Abrams said. "My primary concern is to make sure this does not happen again and to provide to the people whose data is stored in the database important information on how to minimize the risk of potential identity theft and fraud."

Letters to those affected were mailed out beginning Tuesday, and the school recommended those contacted monitor their credit reports. The school has also set up a Web site to provide further information and answer questions from victims of the data breach.