The recent Stanford University data breach is causing businesses to reevaluate their security practices. The way the university handled the breach can serve as a guide for business owners. But it is important to understand the facts of the incident.
Details of the Breach
Stanford University discovered the security concern on Jan. 24, 2023, and immediately corrected the problem. The Department of Economics’ Ph.D. program had a misconfigured folder. Specifically, a folder that should have been restricted became available on the department’s website.
Upon investigation, the university pinpointed the dates of the breach. Anyone could access the folder between Dec. 5, 2022 to Jan. 24, 2023. During that time, there were two downloads of materials. The university reassured everyone that there was no evidence of misused information.
The Affected Information
The relevant folder contained the 2022 to 2023 application files for the Ph.D. program. As such, the data breach exposed accompanying materials and the application itself. For most program applicants, these include the following details:
- First and last name
- Mailing and home addresses
- Date of birth
- Email address
- Phone number
- Citizenship
- Gender
- Race and ethnicity
- Transcripts
- Letters of recommendation
- Resumes
- Personal statements
There was no financial data nor any social security numbers in the documents.
Stanford’s Response
The university notified those affected by the data breach in mid-February. It also hired a data breach and recovery service expert. This expert provides identity protection services, including insurance reimbursement and monitoring, to those affected.
Stanford University has updated its policies for electronic file storage security after the data breach. It also plans to retrain its staff.
Conclusion – And What It Means for Businesses
Data breaches are a growing threat to businesses. The university appears to be lucky that the scope of the breach was small. Even so, it reiterates how important it is for businesses to stay proactive and informed. Businesses should store all files securely. They should also watch for malware in search of credit card details. Implementing safeguards and monitoring for unexpected purchases can protect businesses and their clients.
