Duke Law School announced this week that it has alerted 1,400 people that their Social Security numbers may have been stolen by identity thieves. The numbers were on a school Web site that was hacked.
The people were prospective applicants requesting information from the school’s admissions office, and the Web site stored their information; about 1,400 of these people listed their Social Security numbers on the site. The law school discovered the intrusion last week, took the site offline, and then alerted the possible victims that they were, well, possible victims.
The Privacy Rights Clearinghouse, a nonprofit organization, notes that public institutions are restricted by state and federal laws in their use of Social Security numbers for record-keeping. Duke, however, is a private university.
Universities in general have been sloppy with their use and care of personal information, The Chronicle recently reported. As more evidence of such carelessness, Duke, while chasing down the extent of the break-in, found a second database that might have been accessed from outside. This one didn’t have Social Security numbers, but it did have names, home addresses, e-mail addresses, and passwords. On this site, 1,900 applicants to the law school were listed. Duke notified them earlier this week that their identities might have been purloined as well. —Josh Fischman
