Northeastern Voice

University moves quickly after accidental data release

Northeastern technology experts have been working to mitigate any potential fallout from the inadvertent posting of some students' personal data on the Internet.

A spreadsheet with the names, Social Security numbers and mid-term test scores from an undergraduate physics course for students in the class of 2008 was accidentally posted on an obscure but publicly accessible site at the Fermi National Accelerator Laboratory in spring 2004.

Northeastern's IS security office was notified of the posting this month, and within hours worked to confirm all the information had been removed from the Fermi site and Internet search engines. Within days of that, the university notified the 410 students whose names and numbers were on the spreadsheet.

Officials have also informed the Massachusetts attorney general's office and Office of Consumer Affairs, in compliance with state law.

"This was a human error," said Glenn Hill, director of information security and identity services at Northeastern.

The university stopped using Social Security numbers as student identifiers in 2007, to minimize the potential damage from any such occurrence, he said.

He said Northeastern's quick response stemmed from practices established in 2001. "We do have a security-minded culture at Northeastern, and people know to call us" he said.

There have been no reports of misuse of the data, Hill noted.

In letters to the students, the university noted individuals' options for response, including requesting a "security freeze" on one's credit report, which prevents anyone from establishing credit, loans, insurance and many other services in an individual's name, and checking credit reports regularly.

Northeastern is reviewing security procedures and has communicated with faculty and staff on safeguarding protected information. For several years Hill has sent out quarterly security reminders to faculty and staff, and his office provides monthly security awareness training classes open to all members of the community.

Hill is available to answer questions by writing privacy@neu.edu.