Personal data on more than 7,000 Rice faculty, students, staff, and retirees was contained on a stolen storage device. The data was apparently not encrypted or protected, which means it may very well be exposed to or compromised by the thief, but there is no indication so far that the data has been used so far.
A report from Rice News and Media explains, “Late last month a device containing information for about 7,250 Rice faculty and staff, along with some students and retirees, was stolen. Over the past week administrators discovered that one of the files contained a list of Rice employees and students on the Rice payroll as of January 2010 and included information such as names, addresses, birth dates, employee identification numbers, salaries and emergency contacts, but no Social Security numbers. Another file included Social Security numbers, mostly for Rice employees.”
This is another example underscoring the need for data at rest to be encrypted–particularly sensitive data that can lead to identity theft if exposed to unauthorized users. Technology is becoming increasingly more portable and mobile, which–by definition–also makes it easier to lose or steal. There is little that any organization can do to eliminate the possibility of devices being lost or stolen, so instead organizations should be focused on tools and protection that ensure that the data contained on those devices can not be accessed even if the device is lost or stolen.
