The University of Hawaii has just posted a breach notice concerning the incident described in an earlier blog entry:
The University of Hawai`i – West O`ahu (UHWO) is notifying approximately 40,000 individuals that their personal information may have been compromised.
The exposure occurred when a faculty member inadvertently uploaded files containing data including names, social security numbers, addresses, birth dates and educational information to an unencrypted faculty web server. Individuals potentially affected are students who attended the University of Hawai`i at Mānoa from 1990 – 1998 and during 2001. In addition, students who attended UHWO during Fall of 1994 or graduated from 1988 – 1993 may also be affected.
The faculty member, who is now retired from UHWO, was conducting a longitudinal study of UH students. The faculty member obtained the files from the University of Hawai`i System Institutional Research Office and placed the files containing the information onto the faculty web server in December 2009.
UHWO promptly removed the unintentionally exposed files and disconnected the affected server from the network, after Liberty Coalition, a non-profit group based in Washington D.C., notified University officials about the exposure on October 18. Different files had different information on some of the individuals, but it is believed that the aggregation of the exposed files could allow matching to create the potential for identity theft, which is highly unlikely to occur.
The FBI and Honolulu Police Department have been notified. At this time, UHWO has no evidence that anyone’s personal information was accessed for malicious intent. UHWO is also working with UH System to adopt more proactive security measures to ensure better privacy protection.
Notice what’s missing from the above? No mention that they didn’t discover the breach at all and it had to be pointed out to them.
Their full statement also includes reference to an FAQ on the incident, but it’s not available on the site at the time of this posting.