CONTACT: Jason Foster, foster@mail.sdsu.edu
SDSU Marketing & Communications
(619) 594-2585, pager (619) 620-1184

FOR IMMEDIATE RELEASE

SDSU ALERTING STUDENTS, OTHER GROUPS
ABOUT ILLEGAL SERVER ACCESS
Campus Already Implementing New Computer Security Measures

SAN DIEGO, Tuesday, March 16, 2004 – San Diego State University is notifying more than 178,000 individuals to be on alert after computer intruders hacked into a department file server.

"Our primary concern right now is to let people know what has happened and to provide them with some references to contact to protect themselves from identity theft," said Ellene Gibbs, director of Business Information Management for SDSU. "We are also establishing new security systems and procedures - a process that started before this incident - to ensure information about our students, employees and alumni is as secure as possible."

The hackers circumvented university computer security to access a server in the Office of Financial Aid and Scholarships. The compromised server contained names and Social Security numbers, but the intruders did not have access to aid application or award data.

The server contained information on current, former and prospective students who sent in aid applications or related material, as well as many current and former employees. The vast majority of individuals being notified are ones that provided this information since fall 1998.

SDSU began mailing notification letters Monday, and the process is expected to take several more days to complete. The letters briefly explain the incident and provide contacts for preventing identity theft. The information, posted now at http://security.sdsu.edu/2004-02-01/info.html, includes contact information for credit bureaus individuals can call to request a copy of their credit report or to report any suspicious activity. The Information Technology Security Office has set up a phone number - (619) 594-5393 - for individuals who do not have Internet access to leave a message.

Individuals who detect any suspicious activity are encouraged to contact their local law enforcement agency after notifying the credit bureaus.

The Information Technology Security Office's initial investigation discovered the intruders used the illegal access to send spam emails from the server and for file transfers (including MP3 music files). University Police Detective Steve Harshaw said a criminal investigation is also under way. The FBI is being consulted, since it has personnel who specialize in hacking and other computer-related crimes, and because there is evidence that the hackers broke into the server from another state.

"Computer crimes are a serious and growing concern nationwide for higher education and other institutions, so we're collaborating with specialists in this field who can help us detect and track these perpetrators, wherever they turn out to be," Harshaw said.

Unauthorized computer access is a crime under the section 502 of the state penal code, which prohibits "tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems." Violators are subject to serving up to three years in prison and fines up to $10,000.

To help combat unauthorized access to personal information, SDSU is currently implementing its "Red ID" program, a new, nine-digit ID number system. All students and employees will begin using their Red ID on March 22. Covered transactions include financial payments and disbursements, use of library services, access to personal SDSU Web Portal accounts, and all student services. SDSU will continue to use Social Security numbers for tracking necessary financial, regulatory and reporting transactions.

The university has been working on its alternate ID system since summer 2003. Universities are now required to implement information security programs under the provisions of the Gramm-Leach-Bliley Act.

San Diego State University is the oldest and largest institution of higher education in the San Diego region. Founded in 1897, SDSU offers bachelor's degrees in 79 areas, master's degrees in 67 and doctorates in 14. SDSU's nearly 34,000 students participate in academic curricula distinguished by direct contact with faculty and an increasing international emphasis that prepares them for a global future. For more information, visit www.sdsu.edu.

###