UC Irvine police say 7,000 current or former graduate students could be at risk of identity thieves who already used stolen data to file fake tax returns for 93 students.
Police said Friday they don't know how the information was stolen or who is using it.
Only grad students reported being targeted in the UCI case . the latest in a series of campus security breaches nationwide that led to a state law banning use of Social Security numbers as student identification.
In 2006, UCLA notified 800,000 people that their data might have been hijacked.
Most of the 93 UCI students discovered the thefts when they tried to file electronic tax returns and were told by the IRS that their returns had already been filed, officials said.
"For the last two weeks, we have been scouring all of our databases and computer systems, but we have not found any leak here" on campus, UCI Police Chief Paul Henisey said.
The thefts appear to be part of a larger national case being investigated by the Internal Revenue Service, Henisey said. IRS agents have been on campus as part of the inquiry, he said. Henisey said the trail leads out of state, but would not comment further to avoid jeopardizing the case.
Graduate student Stephanie Casey said she didn't know if her identity was stolen, but she's disturbed that the campus has not been telling students to call the credit agencies and put fraud alerts on their accounts.
Casey said some of her data was stolen when she was an undergraduate at UCLA, but UCLA was more active in addressing the problem.
"All these students don't know how serious it is that their names were sold," Casey said. "UCI is trying to keep it out of the press because it looks horrible for them, but either (an employee) did this or someone they contracted with did this, and they don't want to create mass panic, but this is the kind of thing you should be panicked about."
UCI spokeswoman Jennifer Fitzenberger said UCI sent a campuswide e-mail alert March 20 and set up a page at uci.edu/identitytheftalert with information.
There is also a news item on the university's home page, spokeswoman Cathy Lawhon said. The university has tried hard to alert all potential victims, she said.
Henisey said outside contractors are being examined as a possible source for the leak, possibly including those involved with health insurance, employment and unions.
UCI appears to be the only campus in the UC system or in Orange County that is having the problem, Henisey said.
The issue came to light after several students who live on campus reported the thefts to UCI police, Henisey said. The link to UCI was not immediately known, but as more students came forward to say they'd been targeted, officials realized there was a pattern.
It appears that graduate students or former graduate students between 2004 and 2007 are the ones whose data is at risk, Henisey said.
Since UCI is unable to determine where the problem occurred, so far the only way to find out is for students to file their tax returns electronically and then wait to find out if they get a notice from the IRS saying that a refund has already been processed.
Students can call 949-824-0073 or 949-824-5223 (after hours or on weekends) to report the crime.
Lawhon said the university will lend money at no interest to any student who can't make ends meet because their tax refund is delayed due to fraud. The IRS has agreed to accept paper tax returns, with a copy of the police report attached, and process them, she said.
IRS spokesman Bill Brunson said his agency doesn't comment on unfinished investigations, but identity theft is a problem.
Before the recent tax stimulus package was signed into law, a scam phone bank tried to get people's financial information, promising to direct-deposit the refund checks.
Other fraudulent operations send e-mails with IRS logos, hoping recipients will be fooled into providing personal data.
"The IRS will never ask you for personal and financial information we already have," Brunson said.