Data Security | News

Western Connecticut Uncovers Security Hole; 234,000 Have Data Exposed

• By Dian Schaffhauser
• 12/11/12

Western Connecticut State University has begun the arduous process of notifying its campus community by mail about a data exposure that lasted for more than three years. The challenge is compounded by the fact that a number of those affected have never had any direct relationship with the campus. Administrators said they didn't believe that anybody's personal information was accessed. However, the university is offering up to two years of free identity protection services to those who might be affected.

According to information issued in late November, a storage system vulnerability existed from April 2009 to September 2012, potentially exposing information that included Social Security numbers and financial account information for about 234,000 people. The records involved had been collected over a 13-year period and included students, their families, and others with a campus affiliation. It also included the data of high school students whose SAT scores had been compiled into marketing lists rented by the university, whether or not those students had ever contacted the university.

When the exposure came to light in September, the university communicated with its Board of Regents Information Security & Policy Office to conduct an investigation of the incident in order to determine what had happened and how it would affect those whose data was maintained in the affected storage system. The university also contacted the state Office of the Attorney General for help in determining how to proceed. Following the investigation, the university began sending notices of the exposure to affected people.

"We are disappointed that the potential existed to have these records exposed but we will do everything we can to protect our students, their families and others with whom we have worked," said President James Schmotter. "The steps we are taking and the solutions we are offering to every one of those affected are designed to address any problems this situation may have caused."

Western Connecticut U has set up a hotline to answer calls and also "dramatically increased its information protection capacity with new layers of protection," the institution stated in a frequently asked questions page.