Stolen Hard Drive Had Personal Data

A computer hard drive that was reported stolen from a Georgetown University office Jan. 3 contained identifying information about 38,000 current and former students and employees, university officials announced yesterday.

The hard drive, which had been in a locked room in the Student Affairs office, contained information such as names and Social Security numbers from 1998 to 2006.

Officials told students and employees who could have been affected that they should watch their accounts for signs of fraud.

They are offering free credit monitoring, information sessions, a phone number (866-740-2458) and a Web site ( http://identity.georgetown.edu) with more information.

The D.C. police and GU's Department of Public Safety have been involved in the investigation, and the U.S. Secret Service has been notified.

The student newspaper, the Hoya, posted a story about the incident online yesterday.

Response from alumni and other readers was swift -- and angry, with some demanding that various people be fired and others outraged that the school was still using Social Security numbers for identification.

University spokeswoman Julie Bataille said the school is "moving away from" Social Security numbers. She said that the information was not encrypted but that she thinks it was password-protected.

In the past few years, security breaches have occurred at several local universities, including another incident at GU and others at George Mason University, Johns Hopkins University and the University of Virginia.

In each of those cases -- including the current one at Georgetown -- no misuse of the data has been reported.

A U.S. Government Accountability Office study last year found few instances of identity theft after security breaches in government, the private sector and academia, said Rodney Petersen, who coordinates a security task force for Educause, an information technology association for higher education.

Over the past several years, schools have been investing more time and money in securing computers and networks, shifting away from Social Security numbers, Petersen said.

"But much work remains to be done," he said.