Reporting a Security Incident

As stated in the Administrative Guide Memo on Incident Response, a security incident is defined as:

• Theft or other loss of a laptop, desktop, PDA or other device that contains Prohibited or Restricted Information, whether or not such device is owned by Stanford.
• Attempts (either failed or successful) to gain unauthorized access to a system or its data.
• Unwanted disruption or denial of service.
• The unauthorized use of a system to process or store data.
• Changes to system hardware, firmware or software without the owner's knowledge, instruction or consent.
• OR, a Non-electronic Information Security Incident: real or suspected theft, loss or other inappropriate access of physical content, such as printed documents and files.

Any member of the University community who becomes aware of an information security incident should immediately:

• Submit a HelpSU ticket with IRT Information Security Sevices.
• Contact the University’s Information Security Office by calling (650) 723-2911 or by submitting a HelpSU ticket.

Additionally, you may contact the School of Medicine IRT Information Security group by email (irt-security@lists.stanford.edu) or phone (5-8000, option 4) for assistance.

Any employee who has lost, or had stolen, a device used for Stanford business is responsible for following all school procedures. This includes reporting the situation immediately to the Stanford University Privacy Office. Click here for the procedure for reporting a missing device.

If you suspect that your computer has been hacked (broken into), call the University's Information Security Office at (650) 723-2911 and/or submit a HelpSU ticket.  You may also contact IRT Information Security by email (irt-security@lists.stanford.edu ) or phone (5-8000, option 4).

If you think your server has been hacked, here's a list of things to check, to see if your server has indeed been compromised. You should also contact the Information Security Office and IRT Information Security (above).

You may receive a DMCA (Digital Millennium Copyright Act) notice if the University’s Information Security Office receives a complaint of alleged copyright infringement.  You must work with the University’s Information Security Office to determine if the alleged infringement is valid, and if so, the appropriate steps and behavior that will be expected of you.  Go to dmca.stanford.edu to log in with your SUNetID and resolve the complaint.

If you don't have a SUNetID or can't log in, call the Information Security Office at (650) 723-2911 to arrange for resolution of the DMCA complaint attributed to you. Please refer to the SU# incident number(s) from the Subject line of your notification emails when you call.

If you feel this notice was sent to you in error, contact IRT Information Security by email (irt-security@lists.stanford.edu) or phone (5-8000, option 4) so that we can determined what actually occurred and help prevent it from recurring.

If your computer is not acting as expected, contact your local support person to try to determine the problem.  If the problem does not appear to be a technical problem and persists, contact IRT Information Security by email (irt-security@lists.stanford.edu) or phone (5-8000, option 4).