Wichita State University wichita.edu Wichita State University data breach: what happened and what to do
An unauthorized person accessed a Wichita State University web portal server from December 3 to 5, 2019. A review finished on January 13, 2020 found an old database on it held names, email addresses, dates of birth and Social Security numbers. Letters went out on March 6, 2020.
View all 13,177 breaches- Breach date
- 3 Dec 2019
- Data exposed
- Names, Email addresses, Dates of birth, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Wichita State University said an unauthorized person gained access to a server that ran its student and employee web portals between December 3 and December 5, 2019. The university's first statement, on December 10, said the server held no Social Security numbers.
That changed after a forensic review. On January 13, 2020, the university concluded that a historical database on the server contained names, email addresses, dates of birth and Social Security numbers.
Sources checked: wichita.edu, oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
Notification
Notification letters dated March 6, 2020 went to the people affected, and a call center handled questions. The university said it had no evidence of misuse. It offered 12 months of credit monitoring, identity theft recovery services and a $1,000,000 insurance reimbursement policy.
A former student sued over the delay between the incident and the notice, and the university later settled a class action. Settlement class members were notified around March 12, 2021.
How many people
Sources disagree on the total. Third-party trackers cite very different figures drawn from different state filings, and a Washington state listing counts only residents of that one state. No reliable total exists.
What it means
A Social Security number paired with a date of birth is enough to apply for credit as you. That is the risk to plan for, more than the exposed email address.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops anyone opening new credit in your name. Place one at Equifax, Experian and TransUnion; the FTC explains how. Do this if you were a student, applicant or employee in the portal's records.
- 2
Use the free credit monitoring if you still can
Wichita State University offered 12 months of free credit monitoring. The FTC recommends taking such offers. If you kept your letter, check whether the enrollment deadline has passed, and if it has, a credit freeze still protects you.
- 3
Expect phishing that mentions the breach
Messages about your student account or financial aid may be fake. Don't click links or call numbers in unexpected messages. Go to the company's own website instead, and report scams at ReportFraud.ftc.gov.
- 4
Report misuse and watch your reports
Check your credit reports at annualcreditreport.com. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in other breaches
A free Serus scan checks breach databases for your email address and phone number, so you know what else is out there. Serus can't remove breach data, but it alerts you when your details turn up and tells you what to do.
Official filings
- Washington Attorney General , filed 10 Mar 2020 : 2,649 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Wichita State breach?
If you received a notification letter dated around March 6, 2020, yes. If you think you should have, the university pointed people to a call center in its letter.
What was exposed?
Names, email addresses, dates of birth and Social Security numbers held in a historical database on a portal server.
Is there a settlement?
The university settled a class action over the incident, and settlement class members were notified around March 12, 2021.
Should I freeze my credit?
Yes, if your Social Security number was in the notice. It's free at Equifax, Experian and TransUnion.
Sources
- wichita.edu/about/public_information/wsu_topics/topics_security_incident.php
- oag.ca.gov/system/files/Wichita%20State%20Notification%20Letter%20-%20California_v4%20(FINAL)_2.pdf
- wichita.edu/about/public_information/db_2020.php
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
