MAP | CALMAIL |
Data theft

Information for affected individuals

If my name was on one of the breached databases, does that mean I am the victim of identify theft?
No. The fact that someone had access to your information does not mean that you are a victim of identity theft and/or that your information has already been used by the criminals responsible for the breach. The university wanted to let you know about the incident so that you can take steps to protect yourself. The best way to protect yourself is to place a fraud alert on your credit files and review your credit reports.

How do I know whether my information was on any of the affected databases?
If you received notification from UC Berkeley or Mills College, your name is in the illegally accessed databases. There may, however, be some individuals who did not receive notification due to a recent change of address or other pertinent contact information. Those who do not know whether they are in the compromised database should phone the Data Theft Hotline established by UC Berkeley at (888) 729-3301. Provide your first and last name to the operator, who will ask for the last four digits of your Social Security number in order to validate your identity and confirm whether you are among those whose data were stolen.

If I have confirmed that I am in the affected database, what should I do?
As a precaution, UC Berkeley recommends that you immediately contact one of the three national credit bureaus to place a no-cost, formal fraud alert on your consumer credit file and obtain a copy of your personal credit report. Once a credit bureau places a fraud alert on your credit file, the two other credit bureaus will automatically do the same. Each bureau will then send a confirmation letter with instructions on how to order a credit report. The fraud alert and credit reports are free. Be sure to follow up with the credit bureaus and order your credit reports. Here is the contact information for the fraud divisions of the national credit bureaus:

What is a fraud alert?
Most credit card companies and other creditors will not issue credit without first checking the applicant's credit history. A fraud alert tells credit issuers that there is possible fraud associated with the account and gives them a phone number to call before issuing new credit in your name. This is intended to prevent others from fraudulently receiving credit in your name. When you call the credit bureau fraud line, you will be asked for identifying information and will be given an opportunity to enter a phone number for creditors to call. Credit bureaus will send you a confirmation letter which should include instructions on how to order a free credit report. You should then request a credit report. An initial fraud alert lasts 90 days; you may reinstate it after that.

What should I look for in my credit report?
In your credit report, be alert for any suspicious activity. Look especially for any accounts you did not open and any charges you did not make. Look at the inquiries or requests section for names of creditors from whom you have not requested credit. Look in the personal information section to confirm the accuracy of addresses where you have lived and your Social Security number. Any suspicious activity in these areas may be indications of fraud. Also, be on alert for calls from creditors or debt collectors about bills that you do not recognize and for unusual charges on your credit card bills.

What if there's a problem on my credit report?
If you find anything that looks wrong or suspicious or that you do not understand, call the credit agency at the telephone number listed on your credit report and review the report with a member of the staff. If information in the credit report cannot be explained, you may wish to file a report of suspected identity theft with your local police or sheriff's department.

If the hackers have obtained my campus Student Identification Number, will they be able to access my financial transactions at UHS or financial payments made to the university for registration fees, etc?
No. According to the campus billing office, a Student Identification Number alone – with no password – would not be sufficient for someone to access its sensitive financial data related to registration fee payments and other matters.

What do I do if I am a victim of identity theft?
You should immediately report the crime to your local law enforcement agency, contact any creditors involved and notify the credit bureaus. Detailed information is available on the identity theft victim page on the California Office of Privacy Protection website.

What do I do if I am a victim of medical identity theft?
Medical identity theft occurs when someone uses a person's name and sometimes other parts of their identity — such as insurance information — without the person's knowledge or consent to obtain medical services or goods, or uses the person's identity information to make false claims for medical services or goods.

Extensive information on medical identity theft and steps that you can take to limit your exposure can be found at the World Privacy Forum website.

According to the World Privacy Forum, one way to identify medical identity theft is to place a fraud alert on your credit report. By taking this no-cost step, you will be able to receive copies of your current credit reports. In the past, victims of medical identity theft have found in their credit reports unauthorized entries such as a collection notice for a hospital, medical lab, or for a variety of medical services.

Is there anything else that I can do?
Those wishing to take an additional step may consider placing a security freeze on their credit file. A security freeze means that your file cannot be shared with potential creditors. If your credit files are frozen, even someone who has your name and Social Security number would probably not be able to obtain credit in your name. A security freeze is free to those who have filed a police report of identity theft. If you do not have a police report, it costs $10 to place a freeze with each credit bureau, a total of $30. The credit bureaus require that freeze requests be made in writing. Additional information is available from the California Office of Privacy Protection, including examples of sample freeze request letters (PDF).

  • Equifax Security Freeze
    P.O. Box 105788, Atlanta, GA 30348
    • Send by certified mail.
    • Include name, current and former address, Social Security number, and birth date.
    • Pay by check, money order or credit card (Visa, MasterCard, American Express, or Discover only). Give name of credit card, account number, and expiration date.
  • Experian Security Freeze
    P. O. Box 9554, Allen, TX 75013
    • Send by certified mail.
    • Include full name, with middle initial, and suffix (Jr., Sr., etc.).
    • Include current address and home addresses for the past five years, Social Security number, birth date, and two proofs of residence (copy of driver’s license, utility bill, insurance statement, bank statement)
    • Pay by check, money order, or credit card. Give name of credit card, account number, and expiration date.
  • Trans Union Security Freeze
    P. O. Box 6790, Fullerton, CA 92834
    • Send by regular or certified mail.
    • Include first name, middle initial, last name, and suffix (Jr., Sr., etc.).
    • Include current address and home addresses for the past five years, Social Security number, and birth date.
    • Pay by check, money order or credit card. Give name of credit card, account number, and expiration date.

What is the difference between a fraud alert and a security freeze?
A fraud alert is a special message on the credit report that a credit issuer receives when checking a consumer's credit rating. It tells the credit issuer that there may be fraud involved in the account. Most businesses will not open credit accounts without first checking a consumer's credit history. A security freeze means that your credit file cannot be seen by potential creditors, insurance companies or employers doing background checks — unless you give your consent.

Will a credit freeze impact my financial aid offer or the process of receiving financial aid?
Awarding of financial aid through UC Berkeley would not be impacted. Students will still receive all grants, scholarships, work-study and Federal Direct Loans without delay.

For students applying for a private alternative loan through private banks, a credit freeze may lead to a more careful application review process by the bank. Similarly, if a parent puts a freeze on their credit and applies for a Federal PLUS loan, the Federal government may take longer to review their PLUS credit decision. In 2008-9 less than 2% of students received private loans and just under 9% of undergraduate parents applied for Federal PLUS loans.

Will a fraud alert or security freeze prevent me from using my credit cards or getting new ones?
A fraud alert will not stop you from using your existing credit cards or other accounts. It may slow the process of receiving new credit, since the purpose of a fraud alert is to help protect you against an identity thief opening credit accounts in your name. Potential creditors receive a special message alerting them to the possibility of fraud, and they know that they should reverify the identity of a person applying for credit. With a security freeze, potential creditors, insurance companies or employers doing background checks are not permitted to see your credit history. Among other things, this likely would prevent you from receiving new credit without your explicit consent.

Will UC Berkeley pay for credit monitoring?
By utilizing the free fraud alerts and reviewing free credit reports for suspicious activity, individuals can engage in periodic monitoring of their own credit at no cost. While credit bureaus offer fee-based monitoring services, it is up to individual parties to determine whether they wish to pay for such services. (Please note that Federal Trade Commission and the country's leading consumer groups do not endorse this particular service. They suggest that signing up for a free "Fraud Alert" and placing a "Security Freeze" on your credit file offers a higher level of protection.)

Additional information can also be found at:

Is it OK to give my Social Security number to the credit bureau fraud line?
The credit bureaus ask for your Social Security number and other information in order to identify you and avoid sending your credit report to the wrong person. However, UC Berkeley advises caution if you are contacted by somebody who claims to represent UC Berkeley on this matter and who asks for personal information. The university will not contact you and ask for your full Social Security number, bank account or other personal information. In the case of a fraud alert, potential creditors will contact you to confirm your identity before issuing new credit in your name.

Should I change my Social Security number?
The Social Security Administration very rarely changes a person's Social Security number. The possibility of fraudulent use of your number probably would not be viewed as justification. Also, there are drawbacks to changing your Social Security number. For example, you would lose your credit history, which could make it difficult to get new credit, continue college, rent an apartment, open a bank account or get health insurance.

Should I close my bank account, cancel my credit cards or change my driver's license?
The illegally accessed database does not include any information about bank accounts, credit card accounts or driver's license