Students’ personal information accidentally leaked by UW

/

Photo by Ryan Hueglin
Photo by Ryan Hueglin

56,000 student applicants to the University of Waterloo had their personal information inadvertently exposed as a result of a technology glitch discovered in mid-February.

Now, the university has some apologizing to do.

โ€œWe were very sorry that any applicant data was exposed,โ€ said Nick Manning, director of media relations and issues management at UW. โ€œInformation security is a high priority for us.โ€

UW was informed by a prospective student on Feb. 18 that it was possible to view details from other studentsโ€™ applications in their online student information system.

While the issue was discovered on Feb. 18, information had been open since Feb. 11. The university issued a mass e-mail to students on Feb. 21, explaining the incident.

According to Manning, due to an administrative error, a self-service option that should only be made available to staff had accidentally been turned on.

โ€œMeaning that about 8,000 of our 56,000 applicants in the system were able to use the search function to look at other records,โ€ Manning explained.

For each of those records, an existing applicant could potentially view as other applicantsโ€™ information, such which high school they attended, test scores and prior academic achievements.

However, according to Manning, no names were exposed in the glitch, only applicantsโ€™ ID numbers.

โ€œAll of the applicants could only be identified by their ID number,โ€ Manning assured. โ€œThere was no financial, contact or health information potentially exposed.โ€

However for a number of graduate students applicants, the glitch potentially leaked the name, institution and e-mail address of their referees. As a result, an additional 8,000 referees who were in the system also had their information exposed.

Within 30 minutes of being notified of the glitch, Manning said the schoolโ€™s information technology department fixed the issue. In addition, UW also put new oversight procedures in place to make sure that there are further checks made to any changes within the system.

The school will continue to monitor the online database to make sure that another incident does not occur.

They also contacted Ontarioโ€™s Information Privacy Commissioner, who issued an e-mail statement to The Cord explaining that they were โ€œpresently looking into the incident.โ€

The privacy lapse also affected applicants for joint programs affiliated with UW, including Wilfrid Laurier University and the University of Guelph.

Jessica Lalonde, a student at Laurier Brantfordโ€™s campus, had only just applied for the tri-university history masterโ€™s program when she received the news of a possible identity breech.

โ€œI wasnโ€™t even going to apply to the program initially and then I finally did and I was like โ€˜oh of course the second I apply to it something bad happens,โ€™โ€ she said. โ€œThey reassured me it was limited exposure and I think they did what they could.โ€

Lalonde said that the incident would not have an impact on her decision to accept admission.

Manning also noted that a majority of the applicants were generally co-operative and understanding.

โ€œThe vast majority of people who got back in touch with us were very grateful that they were informed and maybe wanted to know how their application was progressing,โ€ he said.

According to Kevin Crowley, the assistant vice-president of communications, public affairs and marketing at Laurier, 126 graduate students at Laurier were affected by the data error.

โ€œBoth schools take the security of data very seriously,โ€ he said.ย  โ€œItโ€™s unfortunate that it happened in this case, but I believe that UW acted as quickly as they could on it.โ€

Manning stressed that upon a thorough analysis of the database, no unusual activity occurred within the system over the period.

This means that there is no indicator that anyone viewed another studentโ€™s online profile.

โ€œTo the best of our knowledge we are confident that there was no unusual activity,โ€ Manning said.


Leave a Reply

Serving the Waterloo campus, The Cord seeks to provide students with relevant, up to date stories. Weโ€™re always interested in having more volunteer writers, photographers and graphic designers.