Break-In At Berkeley May Have Compromised Data Of 1.4 Million Californians
State officials say it's not clear if names and Social Security numbers were accessed or stolen but urge individuals to take precautions against identity theft.
California state officials revealed Tuesday that in August a hacker broke into a University of California, Berkeley, computer containing a database with the names and Social Security numbers of some 1.4 million Californians.
Carlos Ramos, assistant secretary at the California Health and Human Services Agency, said the breach occurred on Aug. 1 but wasn't detected until the end of the month. It was reported to the state Sept. 21. He confirmed that the California Highway Patrol and the Federal Bureau of Investigation are pursuing the incident and that the hacker has not been found.
He also stressed that it has not been determined whether the information in the database on the compromised system was actually accessed or stolen. "Really, this announcement is a precautionary measure," he says.
The database in question contained the names, addresses, Social Security numbers, and dates of birth of caregivers and care recipients participating in California's In-Home Supportive Services (IHSS) program since 2001. The data was being used in a UC Berkeley study of the effect of wages on in-home care and was obtained with authorization from the California Department of Social Services.
The Social Services Department is urging IHSS participants to follow the recommendations of the Office of Privacy Protection, which include contacting the three major credit bureaus in order to review their credit reports for signs of identity theft and related fraud.
UC Berkeley officials were not immediately available for comment.
"It's a bit ironic," says Jonathan Bingham, president of Intrusic Inc., a security software company focused on internal threats. "The same thing happened to UC Berkeley back in 1998. What it highlights are a couple of factors that are inherently flawed within the industry and within the security profile of not just UC Berkeley but all of the organizations that are out there today."
The university's approach to security is focused too much on keeping unauthorized intruders out and not enough on policing the actions of users deemed by the system to be legitimate, Bingham contends. He points to the fact that the intruder operated for a month before being detected as a sign that those with access need to be watched more closely.
"UC Berkeley has a fairly open network, as most universities do," he says. "They want to give access to as many people as possible, especially in their research network. When you start introducing confidential information into open network settings, you need to have a better ability to detect compromises."
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Infographic: The State of DevOps in 2017Is DevOps helping organizations reduce costs and time-to-market for software releases? What's getting in the way of DevOps adoption? Find out in this InformationWeek and Interop ITX infographic on the state of DevOps in 2017.
Digital Transformation Myths & TruthsTransformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.