Skip to main content

Well, at least the uni didn't try to minimize it:

"On or around November 28, 2023, Butler University’s third-party vendor, Athletic Trainer System ("ATS"), notified Butler University that an unknown actor gained access to ATS's computer systems in August 2020."

As part of steps taken in response, Butler writes: "Butler University is also reviewing the business necessity of sharing any sensitive data with third party vendors."

(SSN had been involved)

Butler University's notification letter sent to 1,871 people can be found linked from https://apps.web.maine.gov/online/aeviewer/ME/40/aebbc4f8-fbd7-4a2d-991b-f1ec97032e39.shtml

#EduSec #Vendor #infosec #hack #databreach

@douglevin @funnymonkey @brett

Office of the Maine AG: Consumer Protection: Privacy, Identity Theft and Data Security Breaches

apps.web.maine.gov
#infosec #hack #databreach #edusec #vendor @funnymonkey @Doug Levin @Brett Callow
in reply to Dissent Doe :cupofcoffee:

Aida Akl
Aida Akl
• •
Sharing data with third-party vendors, which are often the weakest link, is a concept that needs to change because it is no longer sustainable in reality. It 's simply making life easier for cybercriminals. It may seem sustainable in the minds of advertisers, but not in reality.
This entry was edited (2 weeks ago)
in reply to Aida Akl

Dissent Doe :cupofcoffee:
Dissent Doe :cupofcoffee:
• •
@AAKL
What alternative do you propose to sharing data with vendors? Entities are often too big to handle all functions well or efficiently themselves.
@Aida Akl
in reply to Dissent Doe :cupofcoffee:

Brett Callow
Brett Callow
• •
@AAKL We absolutely need GDPR-like data minimization requirements. Organizations should be permitted to hold no more information than is minimally necessary, or to hold it for longer than is minimally necessary.
@Aida Akl
in reply to Aida Akl

Brian Honan
Brian Honan
• •

@AAKL
Under GDPR companies are obligated to ensure any entities they send personal data to must have appropriate security and privacy controls in place. If not the company can be penalised for its third party’s breach

Also, companies have to be transparent about what data they share and for what reasons. This is so I as a data subject can opt out of this or not deal with the company at all

@Aida Akl
⇧