News and Tribune

March 17, 2014

Data breach cost IU more than $80,000

Officials say no sign that personal information was compromised

BY MJ SLABY
(Bloomington) Herald-Times

BLOOMINGTON — A data breach at Indiana University, which exposed personal information of 146,000 students and recent graduates, has cost the university more than $80,000 and 700 personnel hours so far.

As the investigation comes to a close, there is no evidence that anyone’s information has been compromised or used, said university spokesman Mark Land.

Land said a call center, set up to answer questions about the data breach, has received about 930 calls so far, and about half were on the first day. A closing date for the center has yet to be set. The call center number is 1-866-254-1484.

“The call center is still open at least through the end of next week,” he said Friday.

At the end of February, IU reported that data such as names, addresses and Social Security numbers of students and recent graduates who attended the university on any campus from 2011 to 2014 was unsecured for more than 11 months because an authentication point was not working correctly.

IU officials said then and continue to believe that no outside person had accessed the encrypted data.  The information was immediately secured, and officials are looking at all processes to make sure that it doesn’t happen again, Land said.

He said three “web crawlers” or data-mining applications had accessed the data. The crawlers were one for Google, one for a search engine that no longer exists and one for Baidu, a Chinese search engine, he said.

Land said Google has since cleared the information and regardless, the information was encrypted so it would not be easily read.

All students and alumni involved were notified, via email primarily, Land said. He said about 6,200 people didn’t have emails on file with the university, so IU spent more than $6,000 to send them paper letters.

The call center was contracted by the university at $75,000, he said. Land added that most of the 700 personnel hours expended so far were not overtime, although some, especially in the first few days, probably were.