Montana State University: Employee Social Security numbers at risk

Article

The Social Security numbers of about 4,500 past and present Montana State University employees may have been accessible to others because of a computer virus, school officials said.

The Bozeman Daily Chronicle reported that the school earlier this month mailed out letters warning of the problem, which was discovered March 5.

“There’s no evidence this information was grabbed and taken,” said Montana State spokesman Tracy Ellig. “To date, we’ve not had reports of any individuals having problems.”

The employees have been offered a free one-year subscription to a service designed to detect identity theft, said Ellig, who signed up for the service.

The latest security lapse follows another in December 2012 when the school found that birth dates, Social Security numbers, student loans and worker compensation forms had been available online and unencrypted for six weeks the previous summer.

Ellig said the school hired an outside computer forensics company to analyze the hard drive of a computer in the human resources department. The analysis found malicious software capable of getting access to names and Social Security numbers. The company couldn’t find evidence that any information had been taken.

Ellig said names and Social Security numbers of employees are supposed to be kept on a secure server that requires a password, and not downloaded on individual computers.

The school has now installed identity-theft software that searches individual desktop computers on campus.

“Information can end up on computers and the users do not realize it’s there,” Ellig said. “We’re going through and trying to flag every computer that might have identity information.”