Reporting Lost or Stolen Data and Devices
If you have had data stolen, lost data, had a device with data stolen on it, or believe that an individual has broken into your computer, please follow the instructions below.
What Should I Do?
Notify Yale IMMEDIATELY of all events that might be potential breaches of confidential information.
- Call 203-627-4665 if you believe ePHI/PHI ('electronic' or any Protected Health Information) might have been lost, stolen, compromised, misdirected, etc.
- IMPORTANT: DO NOT CANCEL YOUR SERVICE FOR THE PHONE UNTIL ALL DATA HAS BEEN SECURELY REMOVED.
Yale HIPAA professionals will work with you to determine the next steps, and whether the event requires notification. Other incidents involving Yale data should be reported immediately to: firstname.lastname@example.org.
Disconnect it from the network and using a different computer, contact the Information Security Office immediately, by contacting the Help Desk at: email@example.com. Information Security will investigate the incident and help you recover your system. When reporting a possible intrusion, it is helpful if you can provide the following information:
- A description of the problem (what happened and when)
- The computers that were affected (names and IP addresses)
- The actions that have been taken to address this incident
- Any other information or log files that you have
Checklist for reporting lost or stolen electronic media or a computing device
If you need to report lost or stolen electronic media or a computing device, please follow the steps below.
Notify local law enforcement where the laptop was stolen (e.g. Yale Police Department, Prince George's County Police Department, etc.). Be sure you get the case number and primary police contact for the case.
In order to document whether confidential/sensitive data may have been exposed, if it was exposed, and what data was exposed, first consider what kind of information was stored on your computer or device.
Determine if any data belonging to other organizations, corporations, or agencies (e.g. Federal, state or non-profits such as the VA or Yale New-Haven Hospital) were stored on the device.
If you have an ITS network backup account or a backup CD or DVD, you may be able to review the information stored on the device at the time of the last backup by reviewing the backup.
Fill out the Lost/stolen electronic media or computing device form. Upon completion, the form will be automatically routed to Inforamtion Security, Policy, and Compliance team (firstname.lastname@example.org).
Change any passwords you believe may have been used, stored, or saved in memory on the computer or mobile/storage device.
If you stored any confidential data, such as credit card or bank account numbers on the computer or mobile/storage device, you should notify the affected institutions. See the following resources if you believe that your identity has been compromised.
If the computer or device was registered with the Yale University S.T.O.P. program (Security Tracking of Office Property) provided by the Yale Department of Public Safety, call (203) 432-OPEN (6736).
STOP isn't a tracking device like LoJack, but is a prominent, permanently affixed identification plate that labels the laptop as Yale property.
If you enrolled your device in one of their programs, such as Absolute Software's CompuTrace LoJack for Laptops, contact that company.
A police report is needed to activate the tracking service.
Many computers registered for access to the Yale network have a unique Ethernet address number that is recorded by ITS when your computer is registered. It is possible that the computer might be found if it is re-connected to the campus network, using the Ethernet Hardware Address (also known as a "MAC address") of the device. Find your computer's Ethernet Hardware address.
If this is a Yale-owned device, please complete a Property Claim form to report the loss. All forms must be submitted within 24 hours of the incident.
Register the information you have about the machine with the National Stolen Computer Registry. You'll need to provide your computer's serial number. Your computer vendor may also have a registry that allows you to report the computer as stolen.
It also may be the case that if the computer or device is configured to automatically login to a service (such as email) at Yale (no matter where it is physically located), that we may be able to establish a location for the stolen device. If you have any questions or concerns, please feel free to contact us at email@example.com.