Purdue mailing error hits temporary workers
Technorati Tag: Security Breach
Date Reported:
2/3/09
Organization:
Purdue University
Contractor/Consultant/Branch:
None
Location:
West Lafayette, Indiana
Victims:
"individuals or organizations who were employed on a temporary basis by Purdue University in 2008"
Number Affected:
"248 companies and 962 individuals"
Types of Data:
Personal information, including that found on IRS 1099 forms (Names, addresses, employer identification numbers, Social Security numbers, etc.)
Breach Description:
"WEST LAFAYETTE, Ind. - A potential problem involving 1099 forms may affect individuals or organizations who were employed on a temporary basis by Purdue University in 2008. Due to a mailing error, some of these forms were inadvertently sent to the wrong individual or organization."
Reference URL:
Purdue University News Service
The Exponent (original)
The Exponent (update)
Report Credit:
Purdue University
Response:
From the online sources cited above:
WEST LAFAYETTE, Ind. - A potential problem involving 1099 forms may affect individuals or organizations who were employed on a temporary basis by Purdue University in 2008.
Due to a mailing error, some of these forms were inadvertently sent to the wrong individual or organization.
The incident affected 248 companies and 962 individuals, said John R. Shipley, interim vice president for business services and assistant treasurer.
The forms were printed two per page.
Instead of separating the forms and sending them out individually, the two forms were sent to the taxpayer at the top of the page.
[Evan] I have never worked in a mail room before, nor have I been involved in a large mailing operation, but shouldn't there be some kind of test run? It seems like you would really have to be inattentive to have this happen.
Purdue is contacting each recipient to ask that the forms sent in error be returned to the university.
Purdue and its payroll department are committed to protecting the information and privacy of our students, faculty and staff.
[Evan] Just not temps and/or contractors. ;)
If you would like more information, please call toll free at .
"While the incident was unfortunate," Shipley said, "I'm thankful that our staff acted promptly to ensure that all the affected parties were notified in a timely fashion."
How do I guard against identify theft?
Watch your financial statements and credit reports to check for entries that you don't recognize or any new accounts opened in your name.
[Evan] This tip won't guard you against identity theft, this tip only alerts you after the fact.
What action is Purdue taking to prevent illegal access of confidential information in the future?
Purdue has directed all units on all campuses to discontinue the use of Social Security numbers in all records except those that are absolutely necessary or required by law.
[Evan] This is a good idea, but Social Security numbers are required by the payroll department and the information is required on 1099 forms (for individuals).
Purdue also has a large-scale program to improve its security under way called SecurePurdue, available online at www.purdue.edu/securePurdue/theft.cfm
[Evan] I like it!
Purdue is centralizing records that must contain Social Security numbers as well as conforming to a high level of computer authentication, authorization and encryption for access to these records.
Jessica Berger, a high school teacher who leads workshops for Purdue, received someone else’s form in addition to her own.
“I got it on Friday so I had it a whole weekend before I could contact Purdue,” she said. “It was up in the air; it could have been bad, but it worked out OK for us.”
Berger’s husband, Mikel, did not fair so well.
“My husband didn’t know about it because he hadn’t received his form,” she said. “He wouldn’t have known someone else had his form or that this even happened if it wasn’t for my form and me getting someone else’s.”
Commentary:
Errors happen, right?
Past Breaches:
Purdue University:
September, 2007 - Identity Details on 111 Purdue Students Exposed on Internet Server
2/3/09
Organization:
Purdue University
Contractor/Consultant/Branch:
None
Location:
West Lafayette, Indiana
Victims:
"individuals or organizations who were employed on a temporary basis by Purdue University in 2008"
Number Affected:
"248 companies and 962 individuals"
Types of Data:
Personal information, including that found on IRS 1099 forms (Names, addresses, employer identification numbers, Social Security numbers, etc.)
Breach Description:
"WEST LAFAYETTE, Ind. - A potential problem involving 1099 forms may affect individuals or organizations who were employed on a temporary basis by Purdue University in 2008. Due to a mailing error, some of these forms were inadvertently sent to the wrong individual or organization."
Reference URL:
Purdue University News Service
The Exponent (original)
The Exponent (update)
Report Credit:
Purdue University
Response:
From the online sources cited above:
WEST LAFAYETTE, Ind. - A potential problem involving 1099 forms may affect individuals or organizations who were employed on a temporary basis by Purdue University in 2008.
Due to a mailing error, some of these forms were inadvertently sent to the wrong individual or organization.
The incident affected 248 companies and 962 individuals, said John R. Shipley, interim vice president for business services and assistant treasurer.
The forms were printed two per page.
Instead of separating the forms and sending them out individually, the two forms were sent to the taxpayer at the top of the page.
[Evan] I have never worked in a mail room before, nor have I been involved in a large mailing operation, but shouldn't there be some kind of test run? It seems like you would really have to be inattentive to have this happen.
Purdue is contacting each recipient to ask that the forms sent in error be returned to the university.
Purdue and its payroll department are committed to protecting the information and privacy of our students, faculty and staff.
[Evan] Just not temps and/or contractors. ;)
If you would like more information, please call toll free at .
"While the incident was unfortunate," Shipley said, "I'm thankful that our staff acted promptly to ensure that all the affected parties were notified in a timely fashion."
How do I guard against identify theft?
Watch your financial statements and credit reports to check for entries that you don't recognize or any new accounts opened in your name.
[Evan] This tip won't guard you against identity theft, this tip only alerts you after the fact.
What action is Purdue taking to prevent illegal access of confidential information in the future?
Purdue has directed all units on all campuses to discontinue the use of Social Security numbers in all records except those that are absolutely necessary or required by law.
[Evan] This is a good idea, but Social Security numbers are required by the payroll department and the information is required on 1099 forms (for individuals).
Purdue also has a large-scale program to improve its security under way called SecurePurdue, available online at www.purdue.edu/securePurdue/theft.cfm
[Evan] I like it!
Purdue is centralizing records that must contain Social Security numbers as well as conforming to a high level of computer authentication, authorization and encryption for access to these records.
Jessica Berger, a high school teacher who leads workshops for Purdue, received someone else’s form in addition to her own.
“I got it on Friday so I had it a whole weekend before I could contact Purdue,” she said. “It was up in the air; it could have been bad, but it worked out OK for us.”
Berger’s husband, Mikel, did not fair so well.
“My husband didn’t know about it because he hadn’t received his form,” she said. “He wouldn’t have known someone else had his form or that this even happened if it wasn’t for my form and me getting someone else’s.”
Commentary:
Errors happen, right?
Past Breaches:
Purdue University:
September, 2007 - Identity Details on 111 Purdue Students Exposed on Internet Server
Posts Atom 1.0
Comments