Indiana University confirmed the July 4 incident contained information already in the public domain.
(WFIU/WTIU file photo)
Over 248,300 Indiana University records were exposed in a data breach this month, according to Cybernews.
The tech site reported on July 4 the records, including full names and email addresses, were posted on a forum where people share stolen data.
“We have confirmed that data referenced in the Cybernews article contains only names and university email addresses — both of which are already in the public domain and classified by Indiana University as public information," a statement from the university said.
The July breach follows another incident in May, when the university failed to secure 1.3 million files from the confidential Beginning College Student Engagement Survey. Cybernews reported the data from the survey included students’ full names, sexual orientation, race and school-year addresses.
The university said it would conduct a review and work to improve third-party vendor risks to prevent another leak.
Sid Stamm, associate professor of computer science and software engineering at Rose-Hulman Institute of Technology and leader in the university’s cybersecurity education, said data breaches can potentially be bad, but not always. He said sometimes, people report breaches that are accidents or when a breach is just a possibility and the data hasn’t leaked yet.
After data is taken or sold by criminals, the risk depends on the type of data, he said. If an email address is taken, the victim might just receive more spam. If personal information such as a credit card number or its expiration date is taken, there’s a much higher risk of harm.
“The fact that data breaches exist is not the end of the world,” Stamm said. “It sounds really scary, but it’s really just because it's a bug in software or in a system.”
Stamm said people should be concerned and try not to put themselves at risk, but said breaches are not entirely their fault. People should put pressure on companies to be better caretakers of their data, he said, especially as companies collect even more every day.
“If the data is protected, it won’t be lost,” Stamm said. “Proper protection is the most critical thing given the amount of data these companies are collecting about us all the time.”
When companies collect a lot of data, Stamm said, it becomes easier to lose. As technology companies collect much data they can, boosted now by AI processing, people have access to more data than ever before.
“We don’t know how to protect the data as well,” Stamm said. “We don’t know what to do with it yet, and we don’t know how to protect it yet. We’re also a little behind, technology-wise.”
It’s important to build technology safe in the first place to reduce the chance of data breaches, Stamm said, but that’s not always the case.
Deleting unused accounts, freezing credit to prevent new accounts from being open and using password managers are simple ways people can protect their data. Password managers can create strong and unique passwords for different websites, so that users don't have to remember all of them.
“It’s not like things are getting worse, but they can get better,” Stamm said.
Aubrey is our higher education reporter and a Report For America corps member. Contact her at aubmwrig@iu.edu or follow her on Twitter at @aubreymwright. Report for America is a nonprofit national service program that places journalists in local newsrooms to report on undercovered issues.
