News Breach at Berkeley hits 160,000

http://www.bit-tech.net/news/bits/2009/05/11/breach-at-berkeley-hits-160000/1

A security breach on a healthcare system at the University of California at Berkeley which went unnoticed for months has leaked the data on 160,000 individuals.

 

If any student fell foul of any schemes because of this it would seem (I am no lawyer though) that absolutely Berkeley is liable as it was their responsibility to keep the data safe and any loss incurred would be a direct result of their failure to fulfill this responsibility. If you put your money in the bank and the bank got robbed you would fully expect the bank to compensate you because they failed in their responsibility to protect your money.

 

Wonder if it was a 'real' hack or SQL injection type script kiddies Oo

 

ouch

 

*OFF TOPIC*

 

Oh yes because the SSN and Addresses are trivial information.

Of WHAT use would one person's medical records be to another?
"Oh I see here, two years ago, you has pneumonia."
Am I missing something here or is this guy an idiot?

 

Faulk. there are some medical things people wouldn't like public. This introduces blackmail or coersion (sp?) possibilities. I don't think a bout of clamidia is a nice thing to have publicly advertised, nor is a previous history of treatment for drug addiction. Or worse, maybe bi-polar disorder controlled with medication. This would be a perfectly normally functioning person having their life disrupted if the information were used outside of their medical treatment.

 

At least they have brought in the FBI. Many entities try to keep computer transgressions under wraps to protect their "Image". The FBI has been frustrated from mostly the corporate world by not reporting the attacks. They have the ability to connect attacks to other attacks and track down for criminal prosecution, something a company cannot do.

 

ya, I would be a bit perturbed if they required my information, then allowed it to be taken. I would go for a years paid identity theft service, and if anyone did try to use it during the first year then an additional 3 yrs should be provided, paid for by the company that lost the data. I think they should be more embarrassed by the fact that this is the same university that developed BSD. right?