What is identity theft?
Identity theft occurs when an individual or a group of individuals gains access to your personal data, such as Social Security number, birth date, credit card numbers, bank account information etc. They may then choose to use this information fraudulently, possibly affecting your credit and financial history and future.
How do identity thieves work?
Identity thieves may work in the following ways:
They may open a new credit card account, using your name, date of birth and Social Security number. When they use the credit card and don't pay the bills, the delinquent account is reported on your credit report.
They may call your credit card issuer and, pretending to be you, change the mailing address on your credit card account. Then your imposter runs up charges on your account. Because your bills are being sent to the new address, you may not immediately realize there's a problem.
They may establish cellular phone service in your name.
They may open a bank account in your name and write a bad check on that account.
They may use your identity as if it were their own, often committing crimes and hurting other people.
The College would like to emphasize that, at the current time, there is no evidence that any of the data is being used illegally.
How do I reach the credit reporting agencies?
The credit reporting agencies are available 24/7 and can be reached at the following numbers, Web sites and addresses:
Equifax: 800-525-6285 www.equifax.com
PO Box 740250
Atlanta, GA 30374
Experian: 888-397-3742 www.experian.com
PO Box 1017
Allen, TX 75013
TransUnion: 800-680-7289 www.transunion.com
PO Box 6790
Fullerton, CA 92634
How do I issue a fraud alert and what should I say when I call?
Call one of the credit reporting agencies listed below to issue a fraud alert. Once the alert has been issued with one of the three credit agencies, they will alert the other two. YOU DO NOT NEED TO ALERT ALL THREE!
We recommend you alert a major credit reporting agency that there may be a compromise to your personal information, to include your names and Social Security number. Phone prompts will guide you through the process to place a fraud alert on your account.
An initial 90-day alert will then be placed on your account, free of charge. You may extend this fraud alert to a 7-year alert by writing a letter to the credit reporting agencies. You may issue consecutive 90-day alerts, if do not want to issue a 7-year alert.
The following are the addresses and phone numbers of the credit reporting agencies:
Equifax: 800-525-6285 www.equifax.com
PO Box 740250
Atlanta, GA 30374
Experian: 888-397-3742 www.experian.com
PO Box 1017
Allen, TX 75013
TransUnion: 800-680-7289 www.transunion.com
PO Box 6790
Fullerton, CA 92634
By issuing a fraud alert, is my credit affected?
By issuing a fraud alert, it does not change your credit rating. However, when applying for extended credit (for example, mortgages, car loans, credit cards etc.) you will have to actively prove your identity to the credit reporting agencies. The credit reporting agencies can provide you with more information regarding these activities.
Is there a cost to issuing a fraud alert?
No.
How long does the alert stay on the report?
An initial 90-day alert will be placed on your account, free of charge. It is possible to extend this fraud alert to a 7-year alert by writing a letter to the credit reporting agencies. You may issue consecutive 90-day alerts if you do not want to issue a 7-year alert.
Do I need to contact the Social Security Administration?
You only need to contact the Social Security Administration if you are currently a Social Security beneficiary. They can post a message to your account indicating that your Social Security number may be compromised. You do not need to contact the SSA if you do not receive Social Security benefits.
What should I do about my bank account?
At the current time, there is no evidence to suggest that the information contained on the laptop is being used fraudulently. The recommendation from Metro State is to closely monitor your bank account. The College also recommends you contact the bank to alert them that your personal information may have been compromised, to include your bank account number.
Does this include students from all Auraria institutions?
Students who registered at Metro State for a psychology course between the beginning of 1999 fall semester and the end of the 2002 fall semester will appear on the file that was stolen, regardless of the student's home institution.
What should I do if I believe I am a victim of identity theft?
If you are a victim of identity theft, in that persons unknown have attempted to use your identification information for criminal purposes, please report the incident to your local Police jurisdiction and have them include the original Auraria Campus Police Department Offense Report case number: 0701015.
Information for Miscellaneous Callers (Employees and Other Non-students)
What if I want to report on a different issue, such as a criminal activity on campus?
Contact the Auraria Campus Police Department, 303-556-5000
I received an e-mail with the subject “Warning: Confirm your online bank account” (or “Security Alert”). What do I do?
This e-mail is not related to the situation at Metro State. However, you should not reply to the message and immediately delete it as it is probably spam.
Incident Specifics
What exactly happened?
A laptop computer was stolen Feb. 28 in the late afternoon from its docking station in a Metro State faculty member's office in the Department of Psychology on the Auraria Campus. The stolen computer contained roster information of students enrolled in 12 of the faculty member's courses from the beginning of the 1999 fall semester to the end of the 2002 fall semester. The stolen computer was password protected.
The Social Security numbers were used as identifiers of the students as they pertained to the faculty member's classes.
The names and Social Security numbers of these students may have been compromised through this theft.
The case remains under investigation by the Auraria Campus and Denver Police Departments.
Which psychology courses are involved?
If you are one of the 988 students who took one or more of the following psychology courses during the span of the 1999 fall semester to the 2002 fall semester from the professor whose laptop was stolen, your name and Social Security number would have been on the roster that was on computer.
PSY 3570
Cognitive Psychology
PSY 3310
Psychological Research Methods I
PSY 1001
Introductory Psychology
PSY 498I
Organizational Development
PSY 4300
Sensation and Perception
PSY 498I
UR: Selective Attention in Perfectionism
PSY 3320
Psychological Research Methods II
PSY 498G
Teaching Methods Intro to Stats
PSY 4988
UR: Att & Incubation Effects-Insight
PSY 498E
Teaching Methods for Social Psychology
PSY 498X
Impact of Peer Tolerance on Learning Disabled Students
PSY 498Y
Psychology of Religion
What information was on the laptop that is missing?
The laptop contained the names and Social Security numbers, of 988 Metro State students who were enrolled in 12 specific psychology courses taught by one professor from the beginning of the 1999 fall semester to the end of the 2002 fall semester.
Were records from all Metro State students taken in this theft?
No. The roster data only included students who were enrolled in specific Metro State psychology courses during the span of the beginning of the 1999 fall semester through the end of 2002 fall semester.
Has any fraudulent activity been reported yet?
At this time the College has no evidence that personal data were actually retrieved or misused. Currently there is no evidence of identity theft or any other fraudulent activity. As this appears to be a crime of opportunity, it is more likely that the thief was after the laptop to sell it, rather than the data it contained. The Denver Police Department has been notified and is assisting the Auraria Campus Police in tracking pawn shops, E-Bay and other possible outlets for the sale of the laptop.
How do I find out more information?
We have established an Information Hotline to provide you with additional information regarding this incident as well as assist you with the appropriate next steps. Please call 1-877-352-7548 and a representative will be happy to assist you. Also, please use the hotline if you would like to make a report of your concerns or to provide information regarding this incident to the College. Please be assured that Metro State College will do everything it can to provide you the information you desire in a timely manner.
If you would like more information on identity theft, we encourage you to go to the Federal Trade Commission Web site at www.ftc.gov and/or www.ftc.gov/idtheft. This Web site gives you valuable information regarding what identity theft is, how to determine if you have been a victim of identity theft, what to do if you have been a victim and it also provides access to a printable identity theft affidavit. This form allows you to dispute any fraudulent activity on your personal accounts.
You may also visit the following Web sites for more information:
If you have concerns regarding your Social Security number, you may call the Social Security Administration Fraud Hotline at 1-800-269-0271.
What is the Auraria Campus Police Department Offense Report case # for this incident?
The original Auraria Campus Police Department Offense Report case number is 0701015.
Metro State College's Response
What is the College doing?
Metro State is currently working with appropriate law-enforcement personnel as well as identity-theft experts to properly respond to this incident. The College is taking proactive steps to provide as much information as possible to potentially affected students. They are working to provide answers to questions you may have, as well as to allow you to report any fraudulent activity on your accounts. A hotline, 1-877-352-7548, has also been set up as a tip line for you to report any tips you may have regarding the stolen laptop.
Additionally, the College is mailing letters to the last-known addresses of the 988 students who took psychology courses from the faculty member whose laptop was stolen during the span of the beginning of the 1999 fall semester through the end of the 2002 fall semester.
This Web site will be providing additional information on identity theft. We can also provide links to Web sites to review information, or send you material in the mail. The College will also be updating employees and students on a regular basis with any additional information.
Will the College follow-up with me?
You can place a request within the hotline report for the College, indicating that you would like to be re-contacted. A representative from Metro State will contact you shortly to ensure your concerns are addressed.
What will Metro State do if someone's credit has been damaged by this incident?
The College will take all appropriate steps to help remedy the situation, including assisting individuals in dealing with credit agencies. An information line, 1-877-352-7548, has been established to provide information to callers and relay concerns to the College in an efficient manner.
What do I do if I have a tip to report?
The College has also established the hotline for reporting tips. If you have any information regarding the theft call 1-877-352-7548 day or night, so the appropriate steps can be taken.
Is there a reward for providing information?
At the current time there is no reward for bringing forward information. However, the College appreciates any information you can provide regarding this incident.
Can I e-mail someone at Metro State with my questions?
We want to be sensitive to any security concerns regarding e-mail communication. We also are trying to provide information in the most efficient and informative manner possible; therefore, Metro State asks that you call 1-877-352-7548.
What is Metro State doing to make sure this doesn't happen again?
Metro State is committed to the security of its students' personal information and has taken significant steps in the last year to ensure that we are complying with the most technologically up-to-date methods for securing data. These steps include:
Hired an outside firm that conducted a complete audit of information security and prepared a report received by the College in June 2006.
Used that report to build a two–year Security Improvement Project that identified 359 security tasks to be completed. So far, 108 tasks have been completed and 45 tasks are underway. Hired an outside project manager to coordinate and oversee.
In October 2006, the College began scanning all College-owned laptops. When the process is done, there will be no laptops with sensitive data. To date, 25 percent of 400 laptops have been scanned and encrypted, starting with those laptops with the highest probability of containing sensitive information (Social Security and credit card numbers), such as those used by the controller, financial aid, human resources. Information Technology is currently scanning and encrypting 10 laptops a week.
Those in possession of laptops with data have two options for the data: either the sensitive information is deleted in its entirety, or for those who require the sensitive information such as payroll, financial aid and human resources, the information is saved to a network drive with their vice president's authorization.
Made access to sensitive information such as Social Security numbers more restrictive to a limited number of authorized personnel.
Implemented the College's first student and employee password policy requiring a certain level of strength (alpha-numeric, upper-lower case) with a requirement to change it every 120 days.
Outgoing sensitive information, such as employee payroll information communicated to the employee's retirement plan, has been encrypted.
Management of the student information data base (Banner) has been revamped. College personnel can no longer print out Social Security numbers in Banner and the SSN field has been eliminated in areas where it's not needed.
In 2002, student and employee ID numbers were changed from Social Security numbers to today's 900 numbers.
So-called “outward facing” Web sites--those that can be viewed by the public--have been audited and secured so skilled computer hacks can't tunnel into secure sites.
In addition, the College is investigating whether Family Educational Rights and Privacy Act (FERPA) policies were breached.
College Opportunity Fund
If students wish not to use their Social Security number for the College Opportunity Fund, can they change their COF ID to an alternate number?
Yes. Students can fill out the COF stipend application, which can be found on the College Opportunity Fund Web site at: https://cof.college-access.net/cofapp/PDF/COF_form_v_05.pdf
Normally, the form is used to apply for COF, but it can also be used for this change.
On the form, students should state that they would like to stop using the SSN and give the name(s) of any institution of higher education they're attending.
The application can then be faxed to 303-296-1637 or hand delivered to the College Opportunity Fund office.
The College Opportunity Fund will follow a two-step process of inactivating the student's application under SSN and creating a new one under an alternate ID number, which will be communicated to the student. It is the student's responsibility to communicate this new ID number to the college(s) he or she is attending.
