UF officials mailed letters to more than 11,000 current and former students of the College of Liberal Arts and Sciences Tuesday to inform them that their private information, including Social Security numbers, was posted online and may have been accessible to the public.
Names, addresses, Social Security numbers and student record information were collected by two former student employees of the Office of Academic Support and Institutional Service, called OASIS, from CLAS students who expressed a desire to schedule tutoring.
The site was actively used between 2003 and 2005, but was potentially accessible to anyone until it was discovered and removed in May, according to a UF news release Tuesday.
Officials could not find contact information for about 570 students who may have been affected and hope the students hear about the breach and visit the UF Privacy Web site.
This is the largest privacy breach discovered at UF in terms of the number of students affected, said Steve Orlando, UF spokesman.
However, computer forensics have determined with almost certainty that no one has inappropriately accessed the information, he said.
The former employees had posted profiles of the students on the Internet so they could access them from remote locations, but did not install the proper security measures to ensure others could not also access the information, according to the release.
Officials are still trying to determine why it was necessary for the student employees to collect Social Security numbers, Orlando said.
UF used Social Security numbers for identifying students until 2002, when students were given a UF ID number.
Because the information was collected starting in 2003, it's possible that there had been confusion over whether or not it was still appropriate to collect such information, he said.
The information was discovered last month as a result of an ongoing effort to audit all information posted on UF systems for the security of current and former students.
"There are probably literally millions of pages on the university Web site," Orlando said. "If you created a page 10 or 12 years ago, it could very well be out there."
Orlando said it is likely that future breaches will be discovered as the audit, which began last year, continues.
Orlando said students who do not receive a letter within the next few days but suspect that their information may have been compromised should visit http://privacy.ufl.edu and call UF's Privacy Office Hotline at 866-876-HIPA.
