UVic steps up security measures
Jan 31 2012
The University of Victoria has stepped up security patrols of its administration building after the recent theft of personal and banking information on nearly 12,000 current and former employees.
In a preliminary report on the breach to the university's board of governors, senior officials detail steps taken to safeguard the Administrative Services Building in the wake of the break-in.
The moves include increased building patrols by campus security, installing alarms in the entire building, encryption of sensitive material and changes to the storage of payroll information.
"Where changes could be made immediately, they were made," university spokeswoman Patty Pitts said Monday. "The university's doing everything it can to ensure that the private information of its community members is safe.
"We'll await now the results of both the internal assessment and the external review to tell us if what we've done is sufficient or if we need take even more precautions."
The report by university secretary Julia Eastman and vice-president finance and operations Gayle Gorrill goes to the board of governors today.
It also provides new details of the theft, which occurred the evening of Saturday, Jan. 7. The report says a thief or thieves broke into the building's B wing, and stole a number of items, including a mobile storage device with extensive personal and banking information on 11,845 people on the university payroll since January 2010. The information, which included employee names, Social Insurance Numbers and bank account numbers, was not encrypted.
The storage device was kept in a locked box in a "drill proof" safe that was anchored through the carpet to the concrete floor "in an out-of-view cupboard, in a locked room [key pad entry], in a locked building," the report says.
The building's B-wing did not have an alarm system. A university employee discovered the theft the following day and reported it to campus security just before 5 p.m.
Saanich police are handling the investigation. The department revealed last week that someone left a note and most of the stolen items in a Canada Post mailbox in Langford Jan. 18. The key storage device, however, remains missing, heightening concerns that UVic employees could be targets of identity theft or fraud in the future, police said.
Detectives are investigating two suspected fraud cases in which the bank accounts of UVic employees were breached in the days following the theft.
Pitts said the recent developments underline the need for employees to remain vigilant and take necessary steps to protect their bank accounts and identities.
The university has reached a deal to provide employees with a full year of credit-monitoring services free of charge. It hopes to announce details in the next few days. The service would cost employees about $15 a month if they had to pay for it themselves.
The report provides no estimate of the financial impact of the breach, but notes that costs will include the credit-monitoring service, reimbursing employees for expenses incurred while changing their bank information, and the hiring of outside advisers, Deloitte & Touche.
"A full reporting of costs paid by UVic will be provided in the future, once costs are accumulated," the report says.
The university has yet to confirm whether its losses will be covered by insurance through the Canadian Universities Reciprocal Insurance Exchange, the report says.