Dear OSU community member,
We are writing to inform you that your personal information may have been exposed to an unauthorized outside entity when Oregon State University experienced a recent IT security incident.
This matter involves an outside cyberattack that may have gained access to sensitive personal information, including Social Security numbers, names, addresses and phone numbers of approximately 000 students and family members. You are receiving this letter because your information was included in those files.
While we have no indication that the hacker directly accessed your personal information, it is clear that they had the ability to.
We apologize for this incident and any impact on you as a result. We take very seriously our responsibility to protect the data you entrust to OSU, and the university will continuously work to improve its cybersecurity. Although OSU was targeted illegally by a criminal actor, it is in our values to provide transparency and service to our community. This includes taking all measures to prevent future instances of this kind occurring.
As well, OSU is contracting for credit monitoring services to be provided to all those potentially affected by this incident. Please expect to receive a letter in the coming days sent to the address we have on record for you with details on how to sign up for this free service and for additional information that may be useful to you.
You also may want to contact U.S. credit-reporting agencies (Equifax, Experian, and TransUnion) to obtain a free credit report. You can do so by calling 1-877-322-8228 or by logging onto the Annual Credit Report website.
Even if you do not discover suspicious activity on your initial credit reports, the Federal Trade Commission recommends periodic credit report checks as a customary practice as a victim’s personal information is sometimes held or shared for later improper use long after a cyberattack occurred.
To protect yourself from the possibility of identity theft, Oregon law allows you to place a credit freeze on your credit files. By placing a freeze, someone who fraudulently acquires your personal identifying information will not be able to use that information to open new accounts or borrow money in your name. Yet, keep in mind that when you place the freeze, you will not be able to borrow money, obtain instant credit, or get a new credit card until you temporarily lift or permanently remove the freeze.
For more information on how to place a credit freeze, see the website for the Oregon Division of Financial Regulation and click on “Place a credit freeze.” You may also contact the credit-reporting agencies directly to place a freeze:
Equifax: 1-888-298-0045
TransUnion: Fraud Victim Assistance Department, PO Box 6790, Fullerton CA 92834
Experian: Email
If you have immediate concerns and wish to speak to someone about this incident, please call (541)73X-XXXX between the hours of 8 a.m. to 5 p.m. Monday through Friday Pacific Daylight Time.
Sincerely,
Jon Boeckenstedt
Vice Provost for Enrollment Management
David McMorries
Chief Information Security Officer