Feeds

York Uni exposes students' private info

17,000 sets of details fall through website holes

Internet Security Threat Report 2014

The University of York has leaked confidential personal information on students due to website security vulnerabilities.

Details including mobile phone numbers, addresses and A-Level grades of an estimated 17,000 students were exposed as a result of the breach.

University administrators have reported the incident to privacy watchdogs at the Information Comissioners Office. Meanwhile an internal investigation is taking place.

The sensitive data was exposed on a student inquiry page of the university's website accessible to world + dog, not just faculty members, and without any need to log into the site. The student union was expressed particular concern that students’ registered emergency contacts were also exposed by the breach, an aspect of the snafu that meant the breach also affected friends and family of students.

University authorities have admitted the breach and apologised to the affected students as well as promising to tighten up security at the tertiary education facility, the BBC reports.

Aziz Maakaroun, business development director at a vulnerability management specialist Outpost24, said the breach stemmed from a failure to follow best practices on website security.

“Vulnerabilities in websites make it all too easy for hackers to tamper with the content – in this case, posting personal data on the student enquiry page of the University’s public website," Maakaroun said. "To stop this from happening, it is vital that organisations take a more proactive approach to their security by continually scanning for web vulnerabilities which hackers find relatively easy to exploit.” ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.