Southeast Missouri State University is at the center of a crime that has roamed across two states and along the lines of connectivity into the internet.  William Elum was arrested in Atlanta earlier this week in connection with stolen data which he obtained while at SMSU.  While employed at the university, he was a hall director, which gave him access to the personal files of students residing in his dorm.

University officials were first alerted to the breach when two students reported their information was used in the course of credit fraud.  Thankfully, neither of the attempts was successful.  While there has been no word about other criminal activities, university officials advise students to be on the lookout for any inappropriate charges appearing on their credit reports.  While students are able to put a fraud alert on their account or a credit freeze, they are also able to purchase a subscription to an ID theft service.  One such company is Lifelock, which provides a similar service with all three credit bureaus.

Once the initial activity was reported, officials went through the old security logs to see if there were any other fraudulent incidences.  The review of the logs showed that reaching back to April of this year, there had been a number of attempts to use students’ personal data to enter the university’s computer system.  The userid and passwords of the students were compromised and the userid was the same as the social security number of the affected person.

Students were alerted of the breach, by letter, on Thursday of last week.  Although there was a delay of over two weeks between the recognition of the breach and the sending of the letter, university officials say this was a result of finding out which students had been affected.  There were problems with the file logs and some of the data had been corrupted, slowing down the entire notification process.

Elum had left SMSU in 2007 and spent the 2008 school year working at Georgia Tech.  There has been no word if GT will examine its own files to see if Elum committed any similar criminal activity.  The data breach was brought to the attention of authorities in Georgia, where it is a felony to be in possession of unauthorized personal data.  According to insider accounts, Elum is scheduled to appear before the Superior Court of Fulton County on June 30.

The breach occurred during a time when the university was creating a new userid system that did not use social security numbers.  At the time, Elum was able to download the information to his personal laptop.  No word has been released by university officials about security features they have made to their network to prevent the transference of private data to personal computers.