Educational Security Incidents (ESI)

Quick Facts

• Date: 5/14/2008
• Institution: Colorado State University
• Type of Incident: Unauthorized Disclosure
• Number Affected: 204
• Source: SSNBreach.org
• Abstract Source: SSNBreach.org Media Release

Abstract
The Liberty Coalition announced that it has notified Colorado State University that Warner College of Natural Resources student information was available online. The information included the names and Social Security numbers of 204 students and was contained in four different files. Colorado State officials removed the files within an hour of notification and immediately contacted major search engines to remove the files from caches. Colorado State plans to begin notifying affected students in the next few days. This most recent exposure is similar to the January 2008 incident in that the files again belonged to Warner College of Natural Resources, were on the same server and in the same sub-directory of those containing student information in January. According to Colorado State officials, Warner College is implementing plans to regularly scan its web site for files containing personal information.

Quick Facts

• Date: 1/18/2008
• Institution: Colorado State University
• Type of Incident: Unauthorized Exposure
• Number Affected: 300
• Source: SSNBreach.org
• Abstract Source: SSNBreach.org Press Release

Abstract
SSNBreach.org announced that it found four files on a Colorado State University web site containing the personal information on 300 students. These files contained 208 Social Security numbers, usernames and passwords on former Colorado State Warner College of Natural Resources students. The files appear to have been created between 2000 and 2004. The files were removed immediately after notification. Colorado State University Associate Director of Academic Computing & Networking Services Scott Baily stated, "Colorado State University takes personal privacy very seriously, and has policies against maintaining unencrypted files containing sensitive information. Indeed, last year we undertook a campus-wide SSN purge activity, where University-owned computers were scanned in an attempt to remove all files containing sensitive information.... I have contacted Yahoo, the only search engine that we can confirm had these files in their cache.... A total of 114 unique SSNs are involved. CSU has initiated a course of action to notify the affected parties to the extent possible."