Student aid records exposed in security breach
Last Updated: Monday, September 8, 2008 | 3:01 PM ET
CBC News
Police are investigating how confidential information belonging to dozens of students was compromised in a security breach, Newfoundland and Labrador's education minister said Monday.
Student aid records involving 90 individuals were recently accessed without authorization, due to a hole in security involving an online database, Joan Burke said.
"They may have seen the financial information of a spouse, or parents, so it could include tax information, such as your income, your annual income or your social insurance number," Burke told reporters.
The Royal Newfoundland Constabulary is investigating the breach, Burke said. The office of the province's information and privacy commissioner is also investigating.
So far, authorities have traced the source of the breach to a single IP address, but it's not known whether one individual tapped into the database. Burke said authorities also don't know whether the motive was curiosity, or something worse.
"Whether they did it maliciously or found out by mistake or tried to correct something, I can't speak for that," she said.
Exposed data included social insurance numbers, birth dates, addresses and income-related information, as well as signature forms for parents and students.
The breach was detected when a student reported that while filling out an online application form, information belonging to others could be seen.
Burke said the site was taken down and repaired, with an external company hired to oversee the security of the service.
Cameron Campbell, a director of the Memorial University of Newfoundland students union, said student leaders have been assured the issue is under control.
"They've told us the system is completely secure at this point and as soon as they found out about the breach, they shut it all down," Campbell said.
Reegan Anstey, a Memorial University student, said she was unnerved by the disclosure, since she used the site herself this summer to apply for a student loan.
"That was, like, back in June or July, so yeah, I'm hoping I'm not one of those people," she told CBC News.
Records belonging to about 48,000 students were in the database at the time of the breach, Burke said.
This the fifth digital security breach involving the Newfoundland and Labrador government and public agencies in the last year. The others included:
- A consultant working for the public health laboratory last November brought home a government-owned computer, and exposed data after installing a file-sharing program.
- In February, a consultant working for the Workplace Health, Safety and Compensation Commission installed the file-sharing program LimeWire on a computer, exposing information on 153 individuals.
- Also in February, a laptop holding a database with information on 28,000 students was stolen during a break-in at a school board office in St. John's.
- In April, three computers were stolen from a school in Green's Harbour, with personal details about 84 students included in a database on one of them.
