Another Major Iowa Data Breach -

For those of you who don't read the Des Moines Register (That's now almost everyone in Iowa and the world!) here was a short story that most folks did not see except the 93K and their families and fiends who were affected.
(Left - Screen shot of Buena Vista Homepage by Schmidt, 7-17-2010)

By JENS MANUEL KROGSTAD
Des Moines Register

"A database security breach may have exposed personal information of 93,000 people associated with Buena Vista University.

Buena Vista officials in Storm Lake began notifying people Thursday that the privacy of thousands of names, Social Security numbers and driver's license numbers dating back to 1987 may have been compromised last month.

University President Fred Moore said there is no evidence the information has been misused or sold. He apologized for the incident.

The university is offering free credit-monitoring protection and $25,000 fraud insurance for a year to those affected. It hired global auditing firm KPMG to investigate the breach.

Moore did not specify how much the security breach has cost the university, but said it has required a "significant amount of resources." The expenses won't affect tuition, the university's budget or any of its programs, he said.

The school has updated its security policies and procedures. Moore did not detail the changes, citing security concerns. The school's security procedures prior to the breach were evaluated by the auditing firm and were deemed to be comparable to those found at other institutions, he said.

"We're taking steps to upgrade and tighten the security of our network. Unfortunately, no network, no matter how tight, is impervious," Moore said." DSM Register and AP info

So if BVU had a security system comparable to other institutions were are all royally screwed as we used to say! It is just NOT enough to slouch along with sensitive security. There has to be an aggressive push back, a 24-7 command center for data security where every suspicious activity is monitored like NORAD monitored every blip on their radar screen.

We need a new "culture of security" not just some IT guy doing security as part of other jubs which is how most security systems in business, government, and education operate today according to a private, confidential audit we saw in June.

There is almost - No ID Theft Awareness training. No Due Diligence. No FACTA or Red Flag compliance. And NO penalty for data losses! No punishment for lax security.

Someone really needs to sue in one of these data loss cases (TJ MAXX would have been a good one) and get a big class action settlement to shake up those who manage sensitive identity information. Nothing like a good "spanking" to get data managers on the ball.

Buena Vista University's new slogan should be - "Confidently NOT in Control!"

.
.