September 29, 2006
Name
Address
City
Dear {subject name}
The University of Iowa has recently learned that a computer used by our research group was the target of a computer intrusion. This computer contained research data and also included social security numbers for some of the subjects who received payment for participating in research studies conducted in our center. Although there is no evidence that any information was obtained from the computer during this incident, we are writing to inform you that information about your participation in one of our research studies, including your social security number, was contained on the computer.
Appropriate law enforcement agencies have been notified. Analysis of the intrusion indicates it was an automated attack designed to obtain a place to store pirated video files for subsequent distribution.
Given the nature of the incident, we believe the risk to you for identity theft is very low. However we wish to advise you that there are simple precautions you can take to ensure accounts have not been activated in your name without your knowledge. Instructions for placing no-charge fraud alerts in your credit records and other security information can be found at: http://www.consumer.gov/idtheft
We apologize for any inconvenience or concern this situation may cause, but we believe you should be fully informed about this incident. We do not anticipate problems for you; however, we stand ready to answer any questions or provide assistance if needed. Please refer to the enclosed list of questions and answers relating to this incident. You may also look at this material at the following webpage: http://www.psychology.uiowa.edu/FAQ.html.
I want to reassure you that we have no knowledge of any data being accessed or misused. If you suspect any problems associated with this incident, please contact us immediately. The University of Iowa is committed to ensure the security of your personal information. We will work with law enforcement, and continue to evaluate our computer systems and the ways we protect your personal information.
Please feel free to email either one of us: Dr. O'Hara (mike-ohara@uiowa.edu) or Dr. Stuart (scott-stuart@uiowa.edu). You may also contact the University of Iowa’s Institutional Review Board through Martha Jones by calling 319-335-6564 or emailing martha-f-jones@uiowa.edu.
Sincerely,
Michael W. O’Hara
Professor
Department of Psychology
(319) 335-2640
Scott Stuart
Professor
Department of Psychiatry
(319) 353-4230
Enc: List of Questions & Answers regarding this security incident