On Monday, September 12, 2005, Miami University became aware that a grade report from the Fall 2002 semester had been unwittingly placed by a now-retired faculty member into a file that was accessible via the Internet. The report included the Social Security number and grade information on the more than 21,000 students (at all campuses) who attended Miami that fall. The report was removed right away, and Miami has taken steps to notify the graduates and students whose personal information was exposed. Miami has had no reports of unauthorized use of personal information as a result of this file's publication. The university has taken a number of other measures to assure that a similar breach of personal and academic data will not happen in the future.

The University deeply regrets this incident. While the report was placed in a rather obscure file, its potential exposure put at risk the unauthorized release of academic and personal information that we hold dear. We are taking steps to support those who might have been affected and protect unauthorized release of information in the future. Students or alumni who may have been affected are encouraged to call 800-588-9839 from 8 a.m. to 5 p.m. (Central Time), Monday through Friday. Staff experienced in dealing with privacy issues are ready to provide advice and assistance.

We are providing additional information below to answer some questions and direct those affected to other websites that they will find useful. Again, we apologize to all those affected by this incident.

-- J. Reid Christenberry, Vice President for Information Technology

News Release: Miami notifying students, alumni of privacy breach 9/15/05

Questions and Answers

Q. I received the notification via e-mail/letter from Miami about the incident. Does that mean someone stole my personal information and is using it in some way?

A. At this point, Miami has had no reports of unauthorized use of personal information as a result of the inadvertent publishing of this particular grade report. However, the file was exposed to public access for a lengthy time, increasing the potential that personal information was read by someone who could use the information wrongly. Miami is doing all it can to contact all individuals whose information was in that file, so that they can take appropriate steps to protect themselves. (See Identity Theft and Protecting Yourself.)

Q. Exactly what personal information was potentially exposed to the public? If I am a current student, was my information released?

A. The report included name, Social Security number, the grade point average for the Fall 2002 semester, cumulative grade point average, and other related academic information, such as credit hours attempted that semester. The report only included information on students attending Miami (at all campuses) during Fall 2002, so unless you were enrolled at Miami during that particular semester, your name and information was not included in this file.

Q . Is this information still at risk of disclosure to some unauthorized person? What has the university done to assure this won't happen again?

A. Miami has taken every precaution to assure that it is no longer at risk. The grade report has been removed from the file, Internet access has been turned off for the particular computer (a Web server) where the file once existed, and Miami officials have searched other publicly accessible computers on its network to assure that this particular report or variations of this report are not posted on any other public computers. We will enact policy changes to further restrict the distribution of grade reports (or similar reports that include personal and academic information) and to improve the management of Web servers on campus.

Q. I was a student at a regional campus. Were my records exposed?

A. Yes, if you were enrolled in any of Miami's classes in Fall 2002, your information was likely to be on the report.

Q. Who should I contact if I have any additional questions concerning this security breach?

A. Students or alumni who may have been affected are encouraged to call 800-588-9839 from 8 a.m. to 5 p.m. (Central Time), Monday through Friday. Staff experienced in dealing with privacy issues are ready to provide advice and assistance. You can also e-mail the university about the incident at privacyhelp@muohio.edu.

Q. Will Miami contact me to ask for private information because of this event?

A. In similar cases at other institutions, people have reportedly been contacted by individuals claiming to represent the university and who then proceed to ask for personal information, including Social Security numbers and/or credit card information. Please be aware that Miami will only contact you with information regarding steps you should take to prevent possible fraud or identity theft; or if you ask us, by e-mail or telephone, for information. We will not ask for your full Social Security number. We will not ask for credit card or bank information. We recommend that you do not release personal information in response to any contacts of this nature that you have not initiated.

Protecting Yourself

For more information on what you can do to protect your identity, see Identity Theft and Protecting Yourself.