Washington State University wsu.edu Washington State University data breach: what happened and what to do
A safe holding a WSU backup drive was stolen from a storage unit in Olympia on April 21, 2017. Reports put the number of people at roughly 1 million to 1.3 million, with names, Social Security numbers and health information on the drive.
View all 13,177 breaches- Breach date
- 21 Apr 2017
- Data exposed
- Names, Social security numbers, Health information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On April 21, 2017, a safe containing a backup hard drive was stolen from an off-site storage unit in Olympia, Washington. The drive belonged to Washington State University's Social and Economic Sciences Research Center, which runs surveys. Campus Safety reports that it held study data from 1998 to 2013.
The university announced the theft in June 2017. News coverage puts the number of people at around 1 million, and later reporting says up to 1.3 million. The sources differ, so treat the exact figure as approximate. Reports say the drive held names, Social Security numbers and health information, and that much of it was not encrypted. Notices went to adults and to the parents of minors.
This was a physical theft, not a hack, and there is no public report that the data has been used. But a Social Security number with a name is the core of identity theft: it is what lenders and tax agencies use to identify you. If a number is misused, the damage can be new accounts, loans or a tax return filed in your name.
A class action followed, arguing the university was slow to notify people. It settled. Campus Safety reports $4.7 million and Becker's reports $5.26 million, with reimbursement for out-of-pocket losses of up to $5,000 and two years of prepaid credit monitoring. Check the settlement administrator's notice if you received one.
Sources checked: campussafetymagazine.com, dataprivacyandsecurityinsider.com, beckershospitalreview.com
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops new accounts from being opened in your name. Place it with Equifax, Experian and TransUnion, as the FTC explains at https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts. An SSN was among the data reported, so a freeze is the strongest single step.
- 2
Get your free credit reports and watch them
Pull your free credit reports and look for accounts you don't recognize. The FTC explains your options at https://www.identitytheft.gov/databreach.
- 3
Report misuse at IdentityTheft.gov
If someone opens an account or files a return in your name, report it at https://www.identitytheft.gov/databreach and follow the recovery plan the FTC gives you.
- 4
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls about this incident with suspicion. Don't click links in them. Go to the company's website directly, or call a number printed on your card or bill.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases and the dark web for your email and phone number and alerts you if they show up. It detects and alerts; it can't remove data from a breach.
Official filings
- Washington Attorney General , filed 8 Jun 2017 : 769,088 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the WSU breach?
If you took part in a survey run by the university's research center between 1998 and 2013, you may have been included. WSU sent notices to adults and to parents of minors.
What was exposed?
Reports say names, Social Security numbers and health information.
Is there a settlement?
Yes. News outlets reported a class action settlement, with figures of $4.7 million and $5.26 million in different reports.
How many people were affected?
Reports range from about 1 million to 1.3 million people.
Sources
- campussafetymagazine.com/university/wsu-stolen-hard-drive-personal-data/
- dataprivacyandsecurityinsider.com/2017/06/1-million-individuals-personal-data-on-backup-drive-is-stolen-from-washington-state-university/
- campussafetymagazine.com/university/wsu-settles-lawsuit-hard-drive-theft
- beckershospitalreview.com
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
