The University of Waterloo has apologized after accidentally exposing the personal information of 74,000 people, according to university spokesperson Nick Manning.
He said a graduate student applicant to the university notified Waterloo staff on Feb. 18 of a potential exposure of personal information on its graduate application website.
Manning said graduate applicants, such as the one who alerted the university, had the ability to see information usually restricted to students for a week.
“Specifically, that was a search function that allowed him to search and see a number of records of other applicants,” he said.
Manning said university employees responded to the incident within a half hour by enacting stricter privacy settings within the application system.
The exposure has been attributed to administrative error, according to Manning. He said 56,000 applicants were able to access the information, which included applicants’ former grades, schools, and their application identification number.
Manning said the identification numbers were not paired to any applicants’ names.
Since graduate level applicants must present references to qualify for possible admission, the ability to view the full names, email addresses, and institutions of these submitted references were also accessible, Manning said.
“That constituted about 18,000 additional people’s information,” Manning said. “About 74,000 individuals are affected by this potential information exposure.”
After reviewing the university’s system records, he said Waterloo staff did not detect any suspicious or unusual activity recorded within the week the incident occurred. Only about 4,000 applicant students interacted with the application system during this time, according to the records.
Manning said none of the information that was made available would allow identity theft, nor would it affect the application status of any graduate student.
Waterloo has notified all parties whose personal information may have been compromised, he said. The university has also informed Information and Privacy Commissioner of Ontario Ann Cavoukian.
“My office was notified by the University of Waterloo about this unfortunate error and we are presently looking into the incident,” Cavoukian said.
Manning said any graduate applicants who remain concerned regarding this incident can ask for more information at the university’s registrar or graduate student offices.
