UNIVERSITY OF KENTUCKY

University of Kentucky disclosed that an unknown party exploited a vulnerability in its OTIS Digital Driver’s License database between January 8 and February 6, 2021. The vulnerability was identified during a penetration test in early June 2021. The breach exposed usernames (email addresses) and passwords. The university disabled affected passwords and engaged a forensic firm. No other personal information such as SSNs or financial data was involved.

THE UNIVERSITY OF KENTUCKY filed a data-breach notice with the Illinois Attorney General during 2021 (case 21-316). The register records the breach as discovered on June 1, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

A laptop computer containing the protected health information (PHI) of approximately 2,027 individuals was stolen from the University of Kentucky's Department of Pediatrics. The breach, reported to HHS on June 18, 2010, involved a laptop from the New Born Screening Program. The compromised data included names, addresses, dates of birth, social security numbers, and clinical information. In response to an OCR investigation, the university enhanced its encryption, conducted staff training on security and facility procedures, improved physical safeguards, and updated its policies on disclosure accounting.