Hacker Compromised 3,810 Employee Records

To: University of Cincinnati Community

From: Fred Siff,  Vice President and Chief Information Officer

Last week, the University sent e-mails to the 3,810 affected employees whose information was compromised in the hacking incident.  The number of affected UC employees has been reduced due to the results of the investigation. There is no indication that any other employees were affected.

In response to the community’s questions, we will continually update the incident Web page with answers to frequently asked questions (http://www.uc.edu/intrusioninfo/) to stop any false information from spreading through the UC community.  The incident hotline is also still available to answer questions at 556-6400.

There is no indication that the hacker has used this information for any unlawful purpose.  The best weapon to prevent identity theft is to check your credit report periodically to identify if any fraudulent activity is taking place.  With the increasing frequency of identity theft in society, it is best to take advantage of your three free annual credit reports to catch any illegal activity as it occurs. Details and informative links can be found at:

http://www.uc.edu/intrusioninfo/

UCit updated this web page on June 3 and again on June 6 based on this past weekend’s questions from the UC community.  The updates are as follows:

I am receiving e-mails from various banks and Internet services asking me to verify my account/personal information and from other parties threatening to close my e-mail account.  Are these related to the hacking incident?

Do not ever respond to e-mails asking for your personal information.  The hacking incident is not related to the current virus outbreak of e-mail, a variant of the “MyDoom” virus, from a variety of spoofed e-mail addresses (administrator@uc.edu, info@uc.edu, etc.) that warns people their e-mail account will be disabled.  For more information on this virus please see:  http://www.ucit.uc.edu/helpdesk/viruscomplete.asp?ID+37

It is also not related to any of the typical “phishing” e-mails sent out by unknown parties across the Internet every day (examples include e-mails claiming to be sent on behalf of e-Bay, PayPal or banks).  Please disregard these e-mails as you would all other spam.  You should never respond to any e-mails asking you to verify any personal information online.  For more information on “phishing” scams, please see:  http://www.ucit.uc.edu/ucitnow/summer_04/s04_gophish.asp

Should I sign up for a credit monitoring service and/or identity theft insurance?

The University recommends you research any of these services carefully.  We cannot officially recommend any of these services.  Also, in the aftermath of hacking attacks, there are many unscrupulous businesses who contact individuals selling services of questionable nature.  Please be aware that the University does not endorse these services nor has it solicited any business to work on its behalf.