Bowdoin College Data Security Incident - Frequently Asked Questions

Bowdoin College has prepared this Frequently Asked Questions ("FAQ") as a means to provide you with information regarding the possible breach of data security from Bowdoin's computer network.

1. What happened?

For some period of time certain computer files were open and accessible on Bowdoin's computer network to those in the Bowdoin community with a Bowdoin username and password.  A variety of data was contained on these files including some student data such as Social Security numbers, insurance information, medical and lists of students on medical and disciplinary leave.  All of these files are now secure and have been secure since immediately after they were discovered.  We have no reason to believe that any of the information was actually accessed, transferred to, or used by anyone off campus.

To the best of our knowledge, this possible breach does not involve personal investment or financial data, alumni information, or credit card information, but rather files stored by students and employees within personal network folders.

2. What has the College done to address the situation?

Upon finding out about the potential breach, the College immediately secured the files and commenced an investigation of the incident. Bowdoin engaged the services of a computer forensics and investigations firm to further investigate the incident.

3. How likely is it that my identity will be stolen?

We have no reason to believe the data has been misused. In many instances, potential data breaches do not result in identity theft. Nevertheless, we recommend that affected individuals take advantage of the cautionary measures listed in this FAQ.

4. If I don't receive a letter within the next few weeks, does that mean I wasn't affected? How will I know that the letter just didn't get lost in the mail?

Affected individuals are being notified by mail. If you do not receive a letter, it is safe to assume you were not impacted by this situation. However, if you would prefer to have confirmation, you can follow up with us by calling the following number: 207-721-1499.

5. What should I do now?

There are several steps you may take to protect your identity:

a. Request free credit reports, fraud alerts and/or credit freezes.

Every consumer can receive one free credit report every twelve months by contacting one of the three national credit bureaus.  Whether or not you eventually enroll in the Equifax monitoring program, you should periodically request a free credit report to ensure that credit accounts have not been activated in your name without your knowledge.

You can also take the added precaution of placing a fraud alert or credit freeze (where available) on your credit file, which you can do by contacting one of the three national credit bureaus. There may be a charge to place a credit freeze depending upon the state in which you reside, but generally the fees range from $5-$20. (For more details about fraud alerts and credit freezes, see the applicable FAQs, numbers 8 & 9 below.)  Please be advised that placing a credit freeze may restrict your ability to obtain new credit and you may be charged additional fees to "lift" a credit freeze to allow a particular creditor to check your credit history.

b. Review and monitor credit reports.

Once you receive your credit reports, review them carefully for unusual activity, including, for example, inquiries from companies you did not contact, accounts you did not open, and debts on your accounts that you cannot explain.  Other signs may include: receiving credit cards that you didn't apply for; being denied credit, or being offered less favorable credit terms, like a high interest rate for no apparent reason; and getting calls or letters from debt collectors or businesses about merchandise or services you did not buy.  Verify the accuracy of your Social Security number, address(es), complete name and employer(s), and any other information contained in your reports.  Notify the credit agencies if any information is incorrect.  Ask to speak to someone in the security or fraud department, and follow up in writing.  Even if you do not find suspicious activity on your initial credit reports, it is recommended that you check your credit reports periodically over at least the next 12 to 36 months.

c. Review and monitor consumer accounts.

In addition to monitoring your credit reports, you should monitor your financial accounts for suspicious activity. Be sure to report suspected identity theft to the credit bureaus, to the company(ies) maintaining any compromised account(s) and to the proper authorities.

6. How do I contact the three national credit bureaus?

Trans Union: 1-800-680-7289 (http://www.transunion.com)

Experian: 1-888-397-3742 (http://www.experian.com)

Equifax: 1-800-525-6285 (http://www.equifax.com)

7. What do I look for on my credit reports?

When you receive your credit reports, review them carefully. If you find any items that you do not understand on your report, call the credit bureau at the number provided on the report.  Credit bureau staff will review the report with you.  Keep an eye out for any accounts that you did not open or for any incorrect personal information.  If you find any suspicious information or activity in your report, call the credit bureau(s) or your local law enforcement agency to file a report of identity theft.

8. Should I request a fraud alert with the national credit bureaus?

You may want to consider requesting a fraud alert on your credit bureau records.  A fraud alert is a message that credit issuers receive when someone applies for new credit in your name.  A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts.  As soon as one credit reporting agency initiates your fraud alert, the other agencies are automatically notified to place a similar alert.  You can call the fraud department at any one of the three major credit bureaus to make your request.  A fraud alert does not damage your credit or credit score.

a. Do I have to call all three credit bureaus to place a fraud alert on my file?

No. You only need to call one credit bureau; it will notify the other two. A fraud alert will be placed on your file with all three bureaus and you will receive a confirming letter from all three.

b. How long does a fraud alert last?

An initial fraud alert may last 90 days, depending on the policies of the credit bureau. You can remove an alert by calling the credit bureaus at the phone number given on your credit report. If you want to reinstate the alert when it expires, you can do so using the confirmation number you receive when you initiate the fraud alert.

c. Will a fraud alert stop me from using my credit cards?

No. A fraud alert will not stop you from using your existing credit cards or other accounts. It may, however, slow down your ability to get new credit.  Its purpose is to help protect you from an identity thief who tries to open credit accounts in your name. When a new credit account is applied for in your name, the credit issuer is notified of the possibility of fraud. Creditors then typically re-verify the identity of the person applying for credit before issuing the new credit card, line of credit, loan, etc.

d. Can I still apply for credit after I place a fraud alert on my credit report?

You should still be able to get credit.  While a fraud alert may slow the application process, you will still ultimately receive any credit for which you would otherwise be qualified. You simply must prove your identity to the prospective creditor by providing identifying information.

e. Why can't Bowdoin place the fraud alert with the credit agencies for me?

Under the credit agencies' policies, each individual must initiate the action. This is a protection for all individuals on whom the credit agencies maintain records. Bowdoin is not authorized to initiate this action regarding your credit, nor can we determine irregularities in your credit history.

9. What is a "credit freeze" and should I place one on my credit file?

In some states, you have the right to put a "credit freeze" on your credit file, so that no new credit can be opened under your credit file without the use of a pin number that is issued to you when you initiate the credit freeze.  Since the instructions for how to establish a credit freeze differ from state to state, please contact any of the three national credit bureaus to find out more information.  As mentioned above, to place or remove a credit freeze, there may be a charge per action, usually $5-$20, depending on that state in which you reside.  Please be advised that placing a credit freeze may restrict your ability to obtain new credit and you may be charged additional fees to "lift" a credit freeze to allow a particular creditor to check your credit history.

10. Should I contact the Social Security Administration and change my Social Security number?

The Social Security Administration rarely changes a person's Social Security number.  The possibility that an unauthorized individual may have had access to your Social Security number would probably not be viewed as justification for such a change.  For more information, the Social Security Administration website is available at: http://www.ssa.gov.

11. Should I close my bank account?

To our knowledge to date, bank account numbers were not included in the information involved in this security incident.  However, as a general privacy measure, you should limit the use of your social security number when it's not required.  For example, if your bank account number or PIN number is your social security number, you should ask the bank to give you a different number.  DO NOT use the last four digits of your social security number or your date of birth as a password for financial transactions.

12. Should I close my credit card or other financial accounts?

To our knowledge to date, no personal credit card or other personal financial account numbers were included in the information involved in this security incident.  As a general privacy measure, you should always look over your credit card bills and other financial account statements carefully to see if there are any purchases or transactions you did not make.  If so, contact the card company or financial account issuer immediately.

13. Will Bowdoin contact me to ask for private information because of this event?

Other than by the College to notify affected individuals or otherwise in the normal course of school business, no.  You should be aware that in similar cases of security incidents suffered by other entities, such as companies and colleges, people have reportedly been contacted by individuals who claim to represent the company or college.  These individuals have asked for personal information, including social security numbers and/or credit card information.  These people are not representatives of the company; they are people who are attempting to commit fraud.

We recommend that you do not release personal information in response to any contacts of this nature, except when such contacts have been initiated by you (that is, when you have contacted us by telephone or email to request that we contact you).

14. What signs of identity theft should I look for?

There are several signs that may point to identity theft:

  • Accounts you didn't open and debts on your accounts that you can't explain.
  • Fraudulent or inaccurate information on your credit reports, including accounts and personal information, like your Social Security number, addresses, name or initials, and employers.
  • Failing to receive bills or other mail. Follow up with creditors if your bills don't arrive on time. A missing bill could mean an identity thief has taken over your account and changed your billing address to cover their tracks.
  • Receiving credit cards you did not apply for.
  • Being denied credit, or being offered less favorable credit terms, like a high interest rate, for no apparent reason.
  • Getting calls or letters from debt collectors or businesses about merchandise or services you didn't buy.

15. If after checking my bank statement, check report, and/or credit report I notice fraudulent activity - what are my next steps?

  1. Immediately notify your bank of the questionable items and consider closing the accounts that you know, or believe, have been tampered with or opened fraudulently.
  2. You should also contact the three major credit reporting agencies.
  3. You should contact appropriate law enforcement to file a police report, either with your local police or in the community where the identity theft took place. You should also notify your state's Attorney General.
  4. You should also consider filing a complaint with the Federal Trade Commission at 1-877-ID-THEFT or online at www.consumer.gov/idtheft.