KCC Possible Data Breach Alert
Incident Details
On April 15th, a computer that had access to personal information of financial aid applicants was found to be infected with malware. The computer was removed from the network immediately and a forensic investigation initiated. A specific piece of malware was found on the computer that is believed to have the capability to “steal user's sensitive data and communicate with specified Internet websites.”
The infected computer did not itself store sensitive information, but had access to a departmental server used for financial aid processing. The server files included information necessary for financial aid processing including name, address, phone number, date of birth and social security number. While our forensic investigation provided no evidence that any sensitive information was actually accessed by the infected computer, neither did it rule out that possibility. Therefore, we are providing this notice to all individuals whose personal information was on the server and who might be at heightened risk if unauthorized access occurred.
Those identified as at risk include KCC students who applied for or were granted financial aid any time between January 1, 2004 and April 15, 2009, and prior loan borrowers. If you supplied parental information on your financial aid forms, your parents are also at risk.
Again, there is no evidence that your personal information was actually accessed. And no credit card, debit card or bank account information were stored on the server or placed at risk. Nonetheless, Kapi`olani Community College is taking this opportunity to urge any potentially affected individual to take routine protective measures against identity theft. We suggest that you:
- Obtain and carefully review your credit reports. You can order free credit reports from all three credit agencies at http://www.annualcreditreport.com or by calling 877-322-8228.
- Review your bank and credit card statements regularly and look for unusual or suspicious activities.
- Contact appropriate financial institutions immediately if you notice any irregularity in your credit report or any account.
| News Release | Frequently Asked Questions |
| How to Get Your Credit Reports | Placing a Fraud Alert |
| Helpful Resources | If you are a Victim of Identity Theft |
Requesting Copies of Your Credit Report
Given the risks of identity theft today, it's a wise practice to request copies of your credit report from each of the three credit reporting agencies. Under a new federal law, each of them is required to provide one free copy of your report each year. You may want to request more frequent reports.
Each of the credit reporting agencies has their own web site and services. The easiest way to access free credit reports is through the centralized service established by all three agencies at http://www.annualcreditreport.com.
When you receive your credit reports, review them carefully. Look especially for these indicators of possible fraudulent activity:
- Unfamiliar accounts, especially ones that have been newly opened.
- Unauthorized charges to existing accounts.
- Addresses that you have not lived at.
Placing a Fraud Alert on Your Credit Report
(Adapted from and with thanks to UC Berkeley and annualcreditreport.com)
If you have reason to believe that your personal information may have been exposed, you can place a "fraud alert" on your credit file with the three major credit bureaus. This is a free service that will request creditors to verify your identity before opening a new account.
Facts about fraud alerts
Before you add a fraud alert to your credit report, be aware of these effects:
- You may be asked to provide proof of your identification when applying for instant credit. In some cases, the presence of a fraud alert may limit your ability to receive instant credit for in-store purchases that you plan to take possession of immediately.
- Creditors may contact you by phone at a designated number before opening a new account.
- A fraud alert should not interfere with the daily use of credit cards or banking or checking accounts.
The length of time that an alert stays on your record varies for each credit bureau. You can request an extension when the initial period has ended. You have the right to ask that nationwide consumer credit reporting companies place "fraud alerts" in your file to let potential creditors and others know that you may be a victim of identity theft. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to protect you. It also may delay your ability to obtain credit. You may place a fraud alert in your file by calling just one of the three nationwide consumer credit reporting companies. As soon as that agency processes your fraud alert, it will notify the other two, which then also must place fraud alerts in your file.
- Equifax: 1-877-576-5734; www.equifax.com
- Experian: 1-888-397-3742; www.experian.com
- TransUnion: 1-800-680-7289; www.transunion.com
An initial fraud alert stays in your file for at least 90 days.
An extended alert stays in your file for seven years. To place
either of these alerts, a consumer credit reporting company will require you to
provide appropriate proof of your identity, which may include your Social
Security number. If you ask for an extended alert, you will have to provide an identity
theft report. An identity theft report includes a copy of a
report you have filed with a federal, state, or local law enforcement agency.
For more detailed information about the identity theft report, visit www.ftc.gov/idtheft.
If You Are a Victim of Identity Theft
If you find evidence of identity theft on your credit reports AND have verified the fraudulent activities with the financial institutions, take the following steps:
- Immediately close the accounts that you believe have been opened fraudulently or have unauthorized activity.
- File a police report, and get a copy of the report to submit to creditors and others that may require proof of a crime.
- Contact any one of the credit bureaus to place a "fraud alert" on your credit report. See Placing a Fraud Alert for specific details.
- File a complaint with the FTC online at / or by calling 877-438-4338.
- If you discover misuse of your Social Security number, call the Social Security Fraud Hotline, 800-269-0271.
- Keep a record of all communications with credit bureaus, creditors, financial institutions, and police, including dates and who you spoke with.
- Also see http://www.ftc.gov/bcp/edu/microsites/idtheft/consumers/defend.html for more information on how to deal with identity theft.
ID Theft Related Resources
The following web resources contain valuable information about protecting yourself from identity theft and information about what to do if you suspect you are a victim of identity theft.
Federal Trade Commission: ID Theft (http://www.ftc.gov/idtheft/)
This is the main U.S. government site for identity-theft information. The FTC
also maintains a database of identity theft cases used by law enforcement
agencies for investigations. The document “Take Charge: Fighting Back Against
Identity Theft” (available on the FTC site) is an excellent resource and
provides detailed information about identity-theft and what to do if you are a
victim.
Federal Trade Commission's Identity Theft Hotline
877-ID-THEFT (877-438-4338)
Note: The FTC telephone line will present an automated attendant with options
to hear information on ID theft, credit bureaus, requesting fraud alerts, etc.
Callers also have the option of speaking with an ID Theft Counselor (option
#4), Monday through Friday, 8:00 am until 8:00 pm EST. Spanish translation is
available as part of the automated attendant services provided to callers, in
addition to the services provided by the ID Theft Counselors.
US
Dept of Education ID Theft Information (http://www.ed.gov/about/offices/list/oig/misused/idtheft.html)
Information about ID Theft especially for students.
Social Security Administration
Info on Identity Theft (http://www.ssa.gov/pubs/idtheft.htm)
The Social Security Administration provides information on how to report the
fraudulent use of a Social Security card and how to correct your earnings
record.
Social Security Administration's Fraud Hotline: 800-269-0271
Privacy Rights Clearing
House Identity Theft Resources (http://www.privacyrights.org/identity.htm)
Find statistics, fact sheets, and government records about identity theft.
Identity Theft Resource Center (http://www.idtheftcenter.org)
1-868-400-5530
This nonprofit organization provides consumer alerts, scam warnings, and
instructions for victims of identity theft.
Equifax (credit reporting agency,
http://www.equifax.com/)
Fraud Division
800-525-6285
P.O. Box 740250
Atlanta, GA 30374
Experian (credit reporting agency,
https://www.experian.com/)
Credit
Fraud Center
888-397-3742
P.O. Box 1017
Allen, TX 75013
Trans Union (credit reporting
agency, http://www.transunion.com/)
Fraud Victim Assistance Department
800-680-7289
P.O. Box 6790
Fullerton, CA 92634
