Stolen VCU computer puts Social Security numbers at risk

The Social Security numbers of 17,214 current and former Virginia Commonwealth University students may have been put at risk when a computer was stolen from a locked room in Cabell Library.

The desktop computer, stolen in mid-April, may have contained student names, Social Security numbers and test scores dating back to October 2005. VCU discontinued use of Social Security numbers as ID numbers in January 2007.

An additional 22,500 students are being notified that their names, test scores and student ID numbers may also have been on the computer.

VCU spokeswoman Pam Lepley said letters notifying those affected were mailed Thursday. But she said because the information on the computer was encrypted, it is unlikely the thief could have accessed the personal data.

A suspect has been identified by VCU police and the case turned over to the Richmond Commonwealth's Attorney Office.

Assistant Commonwealth's Attorney John Jung said the case will be presented to the grand jury next month. He identified the suspect as a male student who worked part time for VCU.

Campus police say the computer was taken for personal use and disposed of after the suspect became aware he was being investigated, Lepley said. It apparently was thrown away and not sold.

The computer was discovered missing less than a day after the theft and a suspect was identified soon after.

The investigation continued for a month as the university attempted to track the computer through an Internet service provider, Lepley said. The university did not disclose the theft because police did not want to tip off the suspect that the computer contained sensitive information.

Information on the computer is periodically purged, and VCU does not know the extent of the data that remained when it was stolen, Lepley said. Because the computer was not recovered, the university is notifying appropriate government agencies and credit-reporting organizations.

The computer, which was in a locked area within a locked room, was part of a scanning system used to score tests and to record grades for many university classes.

VCU is offering a year of credit monitoring and identity theft insurance worth $1 million per person through Equifax to the 17,214 people whose Social Security numbers potentially were on the computer.

Whether the numbers actually were included would depend on how their professors recorded grades prior to 2007.

Lepley said that while VCU removes Social Security numbers from documents where they are not legally required, it also must retain some official records for five years.

News of the VCU incident comes as the Virginia State Police and the FBI continue to investigate an unrelated security breach at the Virginia Department of Health Professions.

About 531,000 people who had records in the agency's hacked prescription-monitoring database will receive letters this week advising them to keep close watch on their credit record.

Contact Karin Kapsidelis at (804) 649-6119 or .