File this story in the category of even locking data up in a safe is not secure.

Washington State University (WSU) has begun to notify approximately 1 million individuals that their personal data was compromised when a back-up drive that contained the information was stolen from a safe located in the IT Department. The individuals notified included adults and parents of minors.

On April 21, 2017,  WSU learned that a hard drive that contained backup files of WSU’s Social & Economic Science Research Center was compromised when the safe in which it was located was stolen. The hard drive contained 1 million adult and minors’ names, addresses, Social Security numbers, and “other types of information” that was provided in surveys from Washington State agencies, colleges and school districts to WSU.

It is unclear why Social Security numbers were included in the survey results or why the back-up drive was not encrypted while being stored in the safe, both of which would have mitigated the loss suffered by WSU. This is an important reminder that addressing physical security is as important as assessing electronic security to protect personal data.

[View source.]