The University of Iowa Data Breach. Identity Theft?????

My frustrations grow. On September 29, 2006 my wife was one of the potentially thousands of individuals that received a letter from The University of Iowa notifying her of a data breach that involved her name and social security number.

When will corporations, government agencies and education institutes like The University of Iowa take IT security serious? It is time that we not only blame the criminal but we prosecute and hold liable those that lose our personal data. Many times, we have personally entrusted them with our data, others times they have taken the responsibility on themselves. It is time those that are storing private data on citizens act responsible or face severe penalties.

The below are pieces of the not even one page notification The University of Iowa gave my wife.

The University of Iowa has recently learned that a computer used by our
research group was the target of a computer intrusion. Although there is
no evidence that any information was obtained from the computer during
this incident, we are writing to inform you that information about your
participation in one of our research studies, including your social security
number, was obtained on the computer.

They then go on to say.

We apologize for any inconvenience or concern this situation may cause,
but we believe you should be fully informed about this incident.

Great, now what? Is the University of Iowa offering any monitoring service, are they going to follow up with the people that they have let down? Certainly the envelope my wife received in the mail was missing several other sheets of information that explained all those questions.