WVC accidentally releases Social Security numbers

4 free views left!

WVC accidentally releases Social Security numbers

College advises former students to place fraud alerts on credit files

By Rachel Schleif
World staff writer

Thursday, March 31, 2011

WENATCHEE — Wenatchee Valley College accidentally released Social Security numbers of students who attended classes there 10 years ago.

The college sent letters of apology to more than 3,800 former students Monday, and urged them to place fraud alerts on their credit files as a precautionary step.

The mistake happened as the college responded to a public records request from a local law firm asking for 10 years of financial records.

Until fall 2002, the college’s record system tracked students by their Social Security numbers instead of student identification numbers.

In December, the college sent 84,000 pages of data in the response to the request and inadvertently included the Social Security numbers. A student analyzing the data found the numbers and alerted the college on March 24, said Fiscal Services Director Jonah Nicholas.

Nicholas said it’s hard to say how many of those 3,800 former students were included in the records release, but he sent letters to students who attended WVC before 2002, just in case.

The student, Brent Magarrell, said the records also included legal names of students since 2000, along with their corresponding student identification numbers. With an identification number and a birthday, one could hack into students’ college email, registration and financial records, he said.

Magarrell said he filed a complaint about the security breach with the federal Department of Education for a violation of the Family Educational Rights and Privacy Act.

Rachel Schleif: 664-7139

schleif@wenatcheeworld.com

» Recommend this story.

» 14 comments on this story

Want to comment on this story? All Wenatchee World members are invited to comment on stories, by using the form below. Please know that we at wenatcheeworld.com hope our site is useful, entertaining and civil. So we'll delete comments that are obscene, abusive or way off topic. We appreciate it when readers use the "suggest removal" button to flag inappropriate comments. For more about interacting with the site, see our Use Policy.

WhatsUp 2 years, 1 month ago

Oops....

2 years, 1 month ago

I went to WVC 10-14 years ago, so YES, to me it is newsworthy. Why on earth would you think this wasn't newsworthy?

Proudly Anonymous

2 years, 1 month ago

Yes, actually, it is newsworthy. Do you know what can happen if the wrong person gets your Social Security number? Your identity can be stolen and your credit ruined. This is why you should NEVER carry your card in your purse or wallet.

They are required, by law, to notify those that may have been compromised. Its a good thing to put this in the paper in case someone has moved and they can't get a hold of them by their home address that they have on file from over 10 years ago.

2 years, 1 month ago

Why doesn't anyone use the "reply" button when their replying to a specific comment?

Proudly Anonymous

AmyG 2 years, 1 month ago

I was one of the ones that received the letter and I wouldn't have even asked my parents (because that's where the letter would have been sent) whether I got anything if not for this article. Thanks for reporting on this.

Chuck 2 years, 1 month ago

Almost makes you think twice about giving out your SSN on any given form without first asking how it is that such information is legally required.

medicalgal79 2 years, 1 month ago

Yes @girllouise, it's news worthy!!! Imagine if those numbers get in the hands of the wrong people and if what they could do with them. Credit theft destroys people's lives!! It takes years to straighten it out!

girlfawkes 2 years, 1 month ago

"The mistake happened as the college responded to a public records request from a local law firm asking for 10 years of financial records."

Is this a part of the whole using-student-services-funds-to-overfund-the-athletics-department debacle?

Anyway, we need to get the heck away from using SS#'s to verify everything. SS#'s are for Social Security benefits, nothing more. They were never intended to be universal ID numbers. They aren't very secure. If people would quit using them as such they would quit being attractive to identity thieves. Like Chuck says, first ASK if it is required. The government and private enterprise needs to STOP using them to verify identity.

Endrant.

deegee 2 years, 1 month ago

I agree. If I'm paying completely out of pocket for the classes I take at WVC, why would they need my SSN? Even at the bookstore, when I was paying cash for my books, they asked for it. And the cashier got a bit bent out of shape when I asked why she needed it. Since she couldn't give me an answer other than, "We're just supposed to", she didn't get my SSN. If I'm getting student aid/FAFSA funds, yeah, I can see the need, but not if its coming out of my pocket.

Robyn 2 years, 1 month ago

Thank you Wenatchee World for reporting about this, because I checked and found out that I am one of the people who were possibly effected by this.

Masterjoshman 2 years, 1 month ago

"Nicholas said it’s hard to say how many of those 3,800 former students were included in the records release."

Why? Don't they know what was in those 84,000 pages, or did they just do an information dump. If this is how they handle an information request, I'm afraid to ask what else the "financial records" contained.

Thanks Wenatchee World. I'm still waiting for my letter.

ruhroh 2 years, 1 month ago

It wasn't just a law firm that was provided with this information. The file was given to a private citizen who then made multiple copies for other private citizens before realizing that the records contained names and social security numbers. He found mine, called me and read it to me straight from the file. I've spent my whole life maintaining good credit. Now who knows what will happen. All you need to apply for credit online is a person's name, social security number and birthdate.

Masterjoshman 2 years, 1 month ago

LAW 101: You have your terms mixed up. PUBLIC information provided as part of a PUBLIC records request is information available to anyone -- there are no "unauthorized" citizens. The law firm didn't disclose private information, the college did. The dissemination of public information is not a law enforcement issue unless someone uses your SS information to make unauthorized purchases or to do something illegal. Then that individual can be prosecuted. As the article stated, what happened was a violation of the Family Educational Rights and Privacy Act (FERPA), and if the college failed to take corrective measures, the penalty for violation could result in loss of federal funding.