A lost flash drive containing the names and Social Security numbers of an undisclosed number of people associated with the University of Toledo prompted the university to send out letters alerting those affected by the “security incident.”
A UT faculty member lost an unencrypted flash drive containing personal information belonging to some students, faculty, staff, and external research coordinators, according to the letter. That information included names, addresses, and Social Security numbers, and possibly birth dates.
Officials learned Jan. 16 that the flash drive was misplaced and completed a data analysis March 30, according to the letter. There is no evidence that the information has been accessed or used improperly, officials said, calling the notification “an abundance of caution.”
“We wanted to provide you with information about the incident, explain the services we are making available to you, and let you know that we continue to take significant measures to protect your information,” read the letter, dated Tuesday and signed by Lawrence P. Foley, administrator for risk management.
UT spokesman Meghan Cunningham did not answer specific questions, including how many people were affected, but sent a statement that read in part: “The University continually evaluates and modifies our practices to enhance the security and privacy of our students, faculty, staff and external collaborators.
“UT conducted a full investigation of the incident and the employee has been disciplined. The University remains committed to maintaining the privacy of personal information in its possession,” the statement continued.
The university is offering a free, one-year membership to an identity theft monitoring service.
Retired UT professor Douglas Oliver, 62, who taught mechanical engineering for more than 30 years and earned a master’s degree in mathematics there last year, was shocked to receive the letter.
He said he wasn’t angry with the university but was concerned about the security implications for his personal information, particularly about the notification delay.
“They're just letting people know now? It seems rather tardy,” he said. “What we're talking about here is the potential for identity theft. I don't know this [cyber security] world, but I am going to guess that the information is most valuable right after you get it.”
He said he was considering the information monitoring service offer and will be more mindful of his identity security going forward.
“It's just another level of care that I am going to need to take because the University of Toledo evidently was negligent,” he said. “Why was my information on a flash drive anyway?”
UT officials set up a confidential response line available 9 a.m. to 7 p.m. Monday through Friday. That number is 888-420-1666.
Blade staff writer Sarah Elms contributed to this report.
Contact Lauren Lindstrom at llindstrom@theblade.com, 419-724-6154, or on Twitter @lelindstrom.
First Published May 18, 2018, 11:04 p.m.
