Butler University butler.edu Butler University data breach: what happened and what to do
Butler University, in Indianapolis, told people in June 2014 that a remote intruder had accessed its network between November 2013 and May 2014. About 163,000 current and former students, staff and alumni were affected. Birth dates, Social Security numbers and bank account details were involved.
View all 13,177 breaches- Breach date
- Nov 2013
- Made public
- 26 Jun 2014
- Affected
- 163,000
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Butler University learned of the breach on May 28, 2014, when police in California arrested an identity theft suspect who had a flash drive holding data on some Butler employees. The university investigated and found that someone had gotten into its network from outside. Its investigators put the access between November 2013 and May 2014. The suspect had no link to the school, according to reporting by SC Magazine. Butler's notice was added to the California Attorney General's breach list in June 2014.
Sources checked: oag.ca.gov, helpnetsecurity.com, scworld.com
Last verified against the official page:
What was exposed
About 163,000 people were affected, according to Help Net Security. That covers current and former students, faculty, staff and alumni, with some records going back decades. The data included birth dates, Social Security numbers and bank account information.
What that lets criminals do
A name, a birth date and a Social Security number together are what a criminal needs to apply for credit in someone else's name. Bank account details add the risk of fraudulent transfers or direct debits. Because this data doesn't change, the risk doesn't expire the way a leaked password does.
The company's response
Butler said it fixed the part of its network that was exposed and offered affected people one year of free credit monitoring. If you were a Butler student, employee or alum around that time, the notice may have gone to an old address, so don't assume you were missed.
What to do if you were in it
- 1
Freeze your credit
A credit freeze stops new accounts being opened with your Social Security number. It's free at Equifax, Experian and TransUnion, and the FTC explains how.
- 2
Check your bank statements
Look for transfers or debits you don't recognize, and tell your bank right away if you find any. Ask whether it recommends a new account number.
- 3
Report identity theft if it happens
If someone uses your information, report it and get a recovery plan at IdentityTheft.gov.
- 4
Check where else your data shows up
Run a free Serus scan to see whether your email or phone number appears in this or other breaches.
Official filings
- California Attorney General , filed 26 Jun 2014
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Butler University breach?
About 163,000 current and former students, staff and alumni were. Butler sent notices by mail, so if you were connected to the school before mid-2014, treat your information as exposed.
What data was exposed?
Birth dates, Social Security numbers and bank account information, according to news coverage of Butler's notice.
Should I freeze my credit?
If you were affected, the FTC says a credit freeze is a free way to block new accounts being opened in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
