18,700 UVa student Social Security numbers printed on brochures [The Daily Progress, Charlottesville, Va.]

July 18--The Social Security numbers of 18,700 University of Virginia students appeared on the address labels of health insurance brochures mailed across the country in the latest in a string of breaches at the state's flagship university.

The school provided the numbers along with other information to Aetna Health Care, which sent open-enrollment brochures to students' homes through a third-party mail vendor, officials said.

The digits appear above students' names but are not identified as Social Security numbers, said Andrew Elliott, a student who received the brochure.

"It's definitely easily visible if you know what you're looking for," said Elliott, an editor at the school newspaper, the Cavalier Daily, which broke the story Wednesday afternoon. "It isn't separated by the little dashes, but it still looks like a Social Security number."

School officials learned of the error last week.

"The university certainly regrets that this exposure occurred," university spokesman McGregor McCance said in an email. "The university is in the process of notifying students whose information was exposed."

Elliott said he had not been notified.

Officials said they didn't know whether anyone at Aetna or the university saw the mailers before they were sent. Aetna spokeswoman Cynthia Michener said the insurer learned of the breach earlier this week. Aetna provides student health insurance at UVa among 195 schools across the U.S.

Michener said she could not provide details on the mailing process and she didn't know how many mailers the insurer sends each year. She declined to identify the mail vendor, one of several she said Aetna uses.

"We are working with UVa helping to notify the students," Michener said. "We are trying to do the right thing."

Some UVa students were more amused than troubled Wednesday.

"Dude, you only have one job," fourth-year student Hilde Franklin said in a text message, referring to the sender of the brochure.

Another fourth-year student, Jon Stumpf, alluded to possible identity theft.

"I couldn't be happier with the new moped I just bought in India," he said.

The school will provide students with free credit monitoring, McCance said.

"Our focus is on notifying those affected, providing them information regarding credit monitoring and assistance and ensuring that such an incident will not occur again," McCance said.

Such an incident has occurred at UVa before.

--In December, a hand-held device, similar to a smartphone , disappeared from the University of Virginia Medical Center, taking with it the medical and personal information of an undisclosed number of patients treated by Continuum Home Infusion between August 2007 and last September. Hospital officials said the device might have contained patients' names, addresses, diagnoses and medications, along with Social Security numbers in some cases.

--In June 2012, as many as 350 grade transcripts, some containing complete Social Security numbers, were inadvertently posted to a UVa website. Officials blamed human error.

--In June 2007, the university discovered that hackers had accessed the records of 5,735 current and former faculty members over a two-year period. A breach in a computer application exposed such information as Social Security numbers and dates of birth. The university offered a year of free credit monitoring to the people affected.

--In 2006, a spreadsheet listing the Social Security numbers of 632 students was sent to other students in an apparent computer programming error. The computer was supposed to email 1,264 notices to students facing blocks on university accounts, but inadvertently emailed the Social Security numbers of some students to others on the list.

UVa in 2008 announced what it called "a comprehensive initiative to phase out" use of Social Security numbers.

"Although [Social Security numbers] must be collected for selected business functions ... the university will be altering other business functions to use university ID numbers in place, wherever possible," the university said.

That plan was to be completed by last year.

_____

The University of Virginia accidentally printed the Social Security numbers of about 18,700 of the university's 21,000 students on the outside of mailings from the university, a spokesman said Wednesday.</p>

The numbers were printed on address labels attached to letters sent directly to students, said university spokesman McGregor McCance. The Social Security numbers were not labeled as such, McCance said.

UVa officials were in the process of notifying students affected by the error Wednesday afternoon.

"Our focus is on notifying those affected, providing them information regarding credit monitoring and assistance, and ensuring that such an incident will not occur again," McCance said in an email.

UVa will provide free credit monitoring for affected students, McCance said.

___

(c)2013 The Daily Progress (Charlottesville, Va.)

Visit The Daily Progress (Charlottesville, Va.) at www2.dailyprogress.com

Distributed by MCT Information Services