This Web page is designed to provide information about how to respond if you have been notified by Southern Connecticut State University that your personal information may have been involved in a recent data incident concerning the university's Web server. If you have a question related to this notification, please call the help desk line at (203) 392-7216.

Summary:
During a recent security review of the Southern Connecticut State University Web server, it was discovered that certain identifying information pertaining to current students and alumni could have been vulnerable to access by unauthorized individuals. The information, including names, addresses, and Social Security numbers, was contained in a protected records office file in which students would register for graduation. Upon discovering this potential vulnerability, the university immediately disabled the application and secured the file.

There has been no determination that the personal information contained in the file was accessed, nor is there any indication that this data has been or will be used for purposes of identity theft.

 The university has notified all the affected individuals by letter and taken a number of proactive steps, along with a full security review of the university's Web server. For more information, please see the FAQs below:

What happened?
Where was this information stored?
What is the risk that personal information has been compromised?
What has the university done to inform and support students and alumni whose information was contained in this file?
What do I need to do in response to this incident?
What kind of security does Debix provide?
How do I sign up for Debix services?
What other security options can I take?
How do I place a security freeze on my credit report?
How do we respond as individuals if we suspect or discover fraudulent use of our personal information?
What steps is the University taking to reduce the chances of this happening again?
Will the University be contacting me for additional information regarding this incident?
What do I do if I need more information?

What happened?
During a security review of the university Web server in early April, it was
discovered that certain identifying information pertaining to current students and alumni could have been vulnerable to access by unauthorized individuals.
| back to top |

Where was this information stored?
Personal information, including names, addresses and Social Security numbers, was contained in an electronic file through which students would register for graduation. Records of about 11,000 students had been stored in the file dating back to 2002.
| back to top |

What is the risk that personal information has been compromised?
There has been no determination that the personal information contained in the file was accessed, nor is there any indication that this data has been or will be used for purposes of identity theft.
| back to top |

What has the university done to inform and support students and alumni whose information was contained in this file?
The University has undertaken a review of all files containing personal information on its Web server and there is no evidence to date that any of them have been compromised. As a proactive measure, the university has notified all of the affected individuals by letter. The following steps have also been taken:

• Identity protection services will be provided at the university's expense to the affected individuals, for a period of up to two years. To obtain this optional coverage, registration for this service is necessary.
• The option to place a credit report security freeze is also being offered free for a period of up to one year.
• A help desk has been established to respond to questions. The help desk number is: (203) 392-7216 and will be staffed between the hours of 8:30 a.m. to 4:30 p.m. weekdays. Questions may also be emailed to: securityhelp@southernct.edu
• A dedicated Web page, containing updated information, has been created and may be accessed at http://www.southernct.edu/creditmonitoring/

| back to top |

What do I need to do in response to this incident?
If you have received notification from the University that your data was contained in the Web server graduation file, you may want to consider taking steps to monitor your credit and protect against identity theft. Identity protection services will be offered, at the University's expense, to affected individuals for a period of two years. The coverage will be provided by Debix Identity Protection Network ("Debix"). You may also want to consider placing a security freeze on your credit report (see question below: "What other security options can I take?")
| back to top |

What kind of security does Debix provide?
Debix provides the following security features:

• An Instant Authorization call. When someone applies for credit in your name, whether it's you or an imposter, you get a secure, automated call from Debix seeking your authorization before a new account can be opened;
• Identity authentication using your phone number, and other identifying information, so that creditors will know that it is you applying for credit and not an imposter;
• Fraud alerts filed with all three national credit bureaus (Experian, Equifax, and TransUnion), which will be renewed as needed to cover the two-year period; and
• Identify Theft Insurance through AIG in the amount of $25,000.00, which will cover recovery costs, such as lost wages and reimbursement of legal fees and expenses, should that occur.

| back to top |

How do I sign up for Debix services?
Debix registration can be completed either through a special Web site at http://www.debix.com/safe , or through the downloadable mail-in registration form which may be accessed by clicking here: Debix Identity Protection Registration Form. If you do not have access to a computer, you may call the University at (203) 392-7216 and request that a registration form be mailed to you.
| back to top |

What other security options can I take?
You may also wish to place a security freeze on your credit report. You should be aware that should you choose to do so, you will have to lift the freeze each time you wish to permit a potential creditor or other person access to your credit report. In other words, you will have to lift the security freeze each time you apply for a loan or credit, apply for insurance, or wish to permit a potential employer access to your credit report. (Your credit report will still be available to your existing creditors.) You should also be aware that lifting a security freeze can take up to three business days.
| back to top |

How do I place a security freeze on my credit report?
In order to place a security freeze, you must write to each of the three credit bureaus, at the addresses listed below:

Equifax Security Freeze
P.O. Box 105788
Atlanta, GA 30348

Experian Security Freeze
P.O. Box 9554
Allen, TX 75013

Trans Union Security Freeze
P.O. Box 6790
Fullerton, CA 92834-6790.

The letter, which must be sent by certified mail, must contain the following information:

• Your full name, address, Social Security number, and date of birth;
• If you have moved in the past five (5) years, the address of each place you lived over the prior five years;
• Proof of your current address, such as a current utility or phone bill; and
• A photocopy of a government-issued identification card (such as a driver's license or government identification card).

Each credit bureau charges ten dollars ($10.00) to place the freeze. The letter to each credit bureau must be accompanied by payment in this amount by check, money order or credit card (VISA, Master Card, American Express or Discover cards only). The freeze will take effect five business days after the credit agency receives your letter. Ten days after receiving your letter, the credit bureau will send you a confirmation letter containing a unique PIN (personal identification number) or password, which you will need to use when identifying yourself to the credit bureaus.

The University will reimburse you for the initial cost of placing a security freeze, and of one lifting ("thawing") and subsequent reimposition of that freeze, occurring during a period of one year from the date of this letter. (Information pertaining to reimbursement may be accessed by clicking here: Security Freeze Reimbursement. Additional information regarding a security freeze may be found at the following website: http://www.consumersunion.org/pdf/security/securityCT.pdf
| back to top |

What additional steps can I take if I suspect or discover fraudulent use of personal information?
Information regarding additional actions you may consider can be found at:

Federal Trade Commission Identity Theft Data Clearinghouse:
http://www.consumer.gov/idtheft or 1-877-ID-THEFT (438-4338)

Social Security Fraud Hotline (10 a.m. - 4 p.m. EST, Monday Through Friday)
Toll-free number is (800) 269-0271
| back to top |


Will the university be contacting me for additional information regarding this incident?
No. Other than the letter distributed to the affected individuals the week of April 20, the University will not initiate any contact with you concerning this incident.
| back to top |

What do I do if I need more information?
A help desk has been established to respond to questions. The help desk number is: (203) 392-7216 and will be staffed between the hours of 8:30 a.m. to 4:30 p.m. weekdays. After-hours phone messages will be responded to within 24 hours.
Questions may also be emailed to: securityhelp@southernct.edu Questions will be responded to within 24 hours. A dedicated Web page, containing updated information, has been created and may be accessed at http://www.southernct.edu/creditmonitoring/.
| back to top |