University of Tennessee, Martin puts 41 Students at Risk of ID Theft
FOR IMMEDIATE RELEASE: November 11, 2007Media Contact: Aaron Titus
(202) 681-1686
MARTIN, Tennessee. On September 9, 2007 the Liberty Coalition discovered two Excel files on a University of Tennessee, Martin website containing personal information for 240 former high school students who are now between 18-21 years old. The file with the most sensitive information contains 41 names, Social Security Numbers, addresses, high schools, and age, sex, race, and other personal information for 2004 Tennessee Governor's School for the Agriculture Sciences applicants. The Governor's school is a summer program for gifted and talented high school students. The files, online since at least September 2006, expose information protected by FERPA and also put these students at severe risk of identity theft. The exposure was reported to the FBI.
In addition, the online folder contained large quantities of potentially sensitive or protected academic information, such as writing samples, student applications, academic competition scores, and the like. Some files appear to have been posted for a year or more.
According to the official University of Tennessee at Martin Press Release,
"The information was posted accidentally by a UT Martin faculty member, who had backed up files to a publicly accessible server. The 41 applicants are being notified initially by telephone and e-mail and will be contacted again by letter. Additionally, the names and academic information for fewer than 100 university students were posted to the link; Social Security numbers were not associated with these names. These students, who were enrolled in agriculture and natural resources classes, are being contacted and advised of the situation.
"…For questions about the 41 Governor’s School for the Agricultural Sciences applicants, call Dr. Jerry Gresham, 731-881-7262; and for UT Martin students who have questions about the accidental release of academic information, call the Office of Academic Records, 731-881-3050."
The files were inadvertently posted by Timothy N. Burcham, P.E., Ph.D., Master of Science in Agricultural Operations Management Graduate Coordinator, as an effort to back up a computer. Because the online file system at UTM required a password, the faculty member mistakenly believed that the files were not available to the public.
The university acted quickly (after business hours) to remove the files once they were notified, and the University was able to successfully clear several major search engine caches. UT IT staff is or was in the process of identifying 12 separate IP addresses that accessed the sensitive information, including one Chinese IP address. Tennessee does have a breach notification law in the instance of Social Security Numbers, and to their credit, they have decided to notify individuals whose grades or scores have been exposed, even though they're not required to do so by law.
Individuals who applied for the 2004 Tennessee Governor's School for the Agricultural Sciences, from the following high schools may be at special risk of identity theft, and should search for their names at ssnbreach.org right away, to find out whether they were affected:
- Adamsville
- Big Sandy
- Blackman
- Bledsoe County
- Bolivar Central
- Bolton
- Brentwood
- Brighton
- Bruceton Central
- Camden Central
- Chatt Arts/Sci
- Collierville
- Columbia Central
- Columbia Central
- Cornersville
- Covington
- Craigmont
- Creek Wood
- Crockett County
- Culleoka
- Culleoka
- Davidson Academy
- Dickson County
- Dresden
- Dyer County
- Dyersburg
- Fairview
- Forrest
- Franklin County
- Fred J. Page
- Gallatin
- Germantown
- Gibson County
- Gordonsville
- Greenfield
- Halls
- Hardin County
- Harpeth
- Haywood County
- Hendersonville
- Henry County
- Hermitage Springs
- Hillsboro
- Huntingdon
- Kenwood
- Lawrence County
- Lewis County
- Liberty Tech Magnet HS
- Madison Academic Magnet HS
- Marshall County
- McEwen
- McKenzie
- McMinn Central
- McNairy County Central H.S.
- Montgomery Central
- Morristown-Hamblen
- Mt Pleasant
- Munford
- Nashville Christian
- North Side Jackson
- Northwest High Clarksville
- Oak Ridge
- Obion County Central
- Ooltewah
- Peabody
- Polk County
- Ripley
- Riverside
- Rossville Academy
- Santa Fe
- Science Hill
- Siegel
- South Fulton
- South Haven Christian School
- Spring Hill
- St. Andrews-Sewanee School
- Stewart County
- Tipton-Rosemark Academy
- Union City
- Upperman
- Wayne County
- Webb School
- West Carroll
- Westminster Acad.
- Westview
- White House
- White Station
- Wilson Central
- Zion Christian Academy
Individuals affected by this exposure should immediately visit www.nationalidwatch.org and search for their names, to confirm what types of personal information were exposed. NationalIDWatch.org has a list of recommended steps victims should take.
About NationalIDWatch.org
National ID Watch is a search engine for personal information breaches. Sponsored by the Washington, DC non-profit Liberty Coalition, NationalIDWatch.org provides more than a million free personalized Identity Exposure Reports™ as a public service.
Each Identity Exposure Report (IXR) documents what types of personal information were exposed (such as Social Security Numbers, Birth Dates, Addresses, etc.), without revealing them. Each IXR also details the situation surrounding each exposure, and contact information of those responsible for the breach. Armed with this information, victims can further investigate, take action, or correct harm.