Fresno State officials are assessing their security policies after the campus community was notified last week that a hard drive containing personal information of nearly 15,000 individuals was stolen in December.
“We are looking at all policies and how we treat our devices,” said Orlando Leon, Fresno State chief information officer.
The stolen hard drive contained Social Security numbers, credit card numbers and driver’s license numbers from university affiliates, including students, from the years 2003-2014.
“One immediate step that we’re taking is that we’re making sure if we have a hard drive or we have a flash drive, that we’re using [it] to store work information,” Leon said. “We should not be storing Social Security numbers on it unless we really need it.”
According to the ongoing investigation, laptop computers, among other items, were taken from the North Gym over winter break. A police report was filed Jan. 3. Leon said the electronics were stored in faculty, staff and coach offices behind locked doors in the building.
The North Gym is open to the public during the day but the exterior of the building is locked when classes are not in session.
The police report was amended from just stolen laptops to a missing hard drive on Jan. 12.
The university released a statement regarding the breach on March 6, two months after the investigation began.
“We noticed within that first week, after Jan. 12, that we started to see this type of information,” Leon said. “At the time, we had a discussion — this included the president and other people like our CSU legal council — and decided we would actually wait [to share information about the breach].”
Leon said the university waited to disclose the breach in order to identify all known, at-risk persons. This process took them up to March 6.
“At the end, we said we want to make sure we answer confidently if someone were to ask us, ‘Am I affected?’ We wouldn’t want to tell them we’re not sure and you’ll have to wait to find out,” he said.
Mailed notices were sent out on the evening of March 6 to all who were affected. Leon advised that notifications may take up to one week to arrive. A call center was also set up for people to confirm the status of their information in case it was compromised.
“We’re just trying to make sure we’re being as transparent as possible so that people can call if they’re not sure,” Leon said.
He said Fresno State has had various types of incidents similar to this theft, but not to this magnitude, over the past 15 years. The last one occurred in 2011.
“I would say less than five, where there were 100 or 200 records that have been compromised in a similar fashion,” he said.
The police investigation is ongoing. The Fresno State Police Department did not respond to questions from The Collegian by deadline.