Feeds

York Uni exposes students' private info

17,000 sets of details fall through website holes

Remote control for virtualized desktops

The University of York has leaked confidential personal information on students due to website security vulnerabilities.

Details including mobile phone numbers, addresses and A-Level grades of an estimated 17,000 students were exposed as a result of the breach.

University administrators have reported the incident to privacy watchdogs at the Information Comissioners Office. Meanwhile an internal investigation is taking place.

The sensitive data was exposed on a student inquiry page of the university's website accessible to world + dog, not just faculty members, and without any need to log into the site. The student union was expressed particular concern that students’ registered emergency contacts were also exposed by the breach, an aspect of the snafu that meant the breach also affected friends and family of students.

University authorities have admitted the breach and apologised to the affected students as well as promising to tighten up security at the tertiary education facility, the BBC reports.

Aziz Maakaroun, business development director at a vulnerability management specialist Outpost24, said the breach stemmed from a failure to follow best practices on website security.

“Vulnerabilities in websites make it all too easy for hackers to tamper with the content – in this case, posting personal data on the student enquiry page of the University’s public website," Maakaroun said. "To stop this from happening, it is vital that organisations take a more proactive approach to their security by continually scanning for web vulnerabilities which hackers find relatively easy to exploit.” ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.