Reporting Suspected Sensitive Data Exposures

Time is critical

Immediately containing and limiting exposure is our first priority. In some cases, we must notify the Indiana Attorney General within 2 business days of becoming aware of the breach. Individuals affected expect expeditious notification so they can monitor their accounts. The most common complaint after a security breach is about how long it took the organization to contain the exposure and to send notifications. At Indiana University, our goal is to notify the individuals affected within one week of our becoming aware of the possible exposure.

If you suspect a machine has been compromised and it stores/processes sensitive data, do not use the system.