It was indeed the FTC and not the FCC. Too many TLAs in the government, sorry about that :)<br><br>The state is KY.<br><br>The superintendent of the school is aware of the issue, and to be fair, it was actually the vendor that leaked the information (now, whether or not the vendor should have had the information is another question entirely). I believe the vendor (and thus the location of the breach) was in MD, which complicates things a little more. The data was available in "sample reports" that were publicly available on the vendor's website (easily googled). There were certainly not hidden or obscured in anyway whatsoever.<br>
<br><div class="gmail_quote">On Sat, May 3, 2008 at 6:37 PM, Sasha Romanosky <<a href="mailto:sromanos@andrew.cmu.edu">sromanos@andrew.cmu.edu</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><font size="2" color="#0000ff" face="Arial"></font> </div>
<div dir="ltr" align="left"><span><font size="2" color="#0000ff" face="Arial">Was that the FCC or FTC that you notified? The FTC might be
more interested. You could call their 800 number: <font size="3" color="#000000" face="Times New Roman"> </font>
<div>1-877-ID-THEFT<span> (<a href="http://www.ftc.gov/bcp/conline/pubs/credit/idtheftmini.shtm" target="_blank">http://www.ftc.gov/bcp/conline/pubs/credit/idtheftmini.shtm</a>).
In addition to recording your complaint, you could tell them about the breach,
itself.</span></div>
<div><span></span> </div>
<div><span>What state was this in?
Different states require different notification procedures.</span></div>
<div><span></span> </div>
<div><span>cheers,</span></div>
<div><span>sasha</span></div></font></span></div><br>
<blockquote style="border-left: 2px solid rgb(0, 0, 255); padding-left: 5px; margin-left: 5px; margin-right: 0px;">
<div dir="ltr" align="left" lang="en-us">
<hr>
<font size="2" face="Tahoma"><div class="Ih2E3d"><b>From:</b> <a href="mailto:dataloss-bounces@attrition.org" target="_blank">dataloss-bounces@attrition.org</a>
[mailto:<a href="mailto:dataloss-bounces@attrition.org" target="_blank">dataloss-bounces@attrition.org</a>] <b>On Behalf Of </b>Aaron
Allen<br></div><b>Sent:</b> Saturday, May 03, 2008 12:11 PM<div class="Ih2E3d"><br><b>To:</b>
<a href="mailto:dataloss@attrition.org" target="_blank">dataloss@attrition.org</a><br><b>Subject:</b> [Dataloss] Reporting
Dataloss<br></div></font><br></div><div><div></div><div class="Wj3C7c">
<div></div>Back in November 2007, I uncovered a data breach containing about
7000 partial names, addresses and full SSNs of students that graduated from
the public school system from which I graduated in 2002. The data was
publicly posted on a website of a vendor that the school had used. Here
is an example line from the leak:<br>
<table width="1026" align="BLEEDLEFT" border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr valign="top"></tr>
<tr valign="top">
<td colspan="3" width="30"><br></td>
<td colspan="7" rowspan="2" width="92"><font size="2" face="Arial"><b><u>Permanent
Number</u></b></font></td>
<td colspan="4" width="40"><br></td>
<td colspan="3" rowspan="2" width="53"><font size="2" face="Arial"><b><u>LAST
NAME</u></b></font></td>
<td colspan="2" width="20"><br></td>
<td colspan="4" rowspan="2" width="51">
<table cellspacing="0">
<tbody>
<tr>
<td align="left"><font size="2" face="Arial"><b><u>FIRST
</u></b></font></td></tr>
<tr>
<td align="left"><font size="2" face="Arial"><b><u>NAME
</u></b></font></td></tr></tbody></table></td>
<td colspan="11" width="216"><br></td>
<td colspan="5" rowspan="2" width="79"><font size="2" face="Arial"><b><u>Geocode
Status</u></b></font></td></tr>
<tr valign="top">
<td colspan="17" width="335"><br></td>
<td colspan="4" width="40"><br></td>
<td colspan="2" width="20"><br></td>
<td colspan="5" width="62"><br></td>
<td width="64"><font size="2" face="Arial"><b><u>Address</u></b></font></td>
<td colspan="3" width="58"><br></td>
<td colspan="4" width="61"><font size="2" face="Arial"><b><u>ZIP</u></b></font></td>
<td width="11"><br></td>
<td colspan="3" width="59"><font size="2" face="Arial"><b><u>GRADE</u></b></font></td></tr>
<tr valign="top">
<td colspan="62" width="1006"><br></td></tr>
<tr valign="top">
<td colspan="16" width="325"><br></td>
<td colspan="12" width="142"><font size="2" face="Arial">401999999</font></td>
<td colspan="6" width="84"><font size="2" face="Arial">XXXXX</font></td>
<td colspan="6" width="74"><font size="2" face="Arial">......hia</font></td>
<td colspan="5" width="140"><font size="2" face="Arial">.......estown
Rd</font></td>
<td width="10"><br></td>
<td colspan="3" width="48"><font size="2" face="Arial">40511</font></td>
<td colspan="2" width="26"><br></td>
<td width="25"><font size="2" face="Arial">D</font></td>
<td colspan="4" width="54"><br></td>
<td width="28"><font size="2" face="Arial">09</font></td></tr></tbody></table><br>Note that I changed the social
security number to protect the innocent, but everything else is the
same. As you can see, the data provided was full social, last three
letters of the first name, partial address, full zip, the high school the
student was attending in the year 2001, and the grade they were in when they
attended that school. I notified both the vendor and the school district
and they removed the information. They told me they would not notify the
affected individuals because the amount of information contained in the leak
was so small that it was useless to any potential ID theif.<br><br>However,
because the breach targets such a small group of individuals I was easily able
to go through the information and using publicly available information fill in
a lot of missing information and obtain full SSN, name, addresses, and phone
numbers. I have also notified the FCC and attempted to contact other
agencies, but no one seems to really care that this data loss has
occurred. Now, several months later, I have found out that I am a victim
of identity theft (someone filed taxes under my SSN). While there is no
way to link these two incidents, it has caused me to look back into this data
leak I discovered back in Nov.<br><br>So, my question to the list is what is
the best way and to whom do you report a data loss event that neither of the
responsible parties are willing to disclose?<br><br>Or, am I just being too
paranoid and the amount of data that was leaked should not be a cause for
concern?<br></div></div></blockquote></div>
</blockquote></div><br>