I appreciate the opportunity to respond to the concerns raised about the privacy of FERPA-protected data. The security of our students’ personal information is our highest priority.
First, I want to be clear: At no point was the security of OU IT systems breached. Rather, some sensitive files were inadvertently made accessible to OU account holders due to a misunderstanding of privacy settings. No unauthorized party accessed any of the files mentioned in the OU Daily story except for the story’s author. As soon as OU IT became aware of this situation, the tool enabling the file search was immediately closed. All FERPA-protected files are secure.
I want to provide some background about how this situation arose. OU users can store shared files in spaces called SharePoint team sites. Certain departments store FERPA-protected data on these sites to share within their staff, which is permitted. However, in some cases, the privacy setting options of these sites were misinterpreted, inadvertently allowing access to any OU account holder.
OU’s Office 365 software suite includes collaboration tools such as SharePoint and Delve. Delve allows users to search their SharePoint files using keywords, similar to a Google search. Any SharePoint site with the open privacy setting was searchable to any user within the OU system. This is how the Daily was able to access the sensitive data in question.
OU IT immediately shut down Delve, and the service is not currently available to any OU user. Furthermore, the SharePoint sites accessed by the Daily were immediately restricted to authorized staff users only.
While there was no outside breach of our files, we understand and acknowledge concerns about the vulnerability of sensitive data. We rectified the situation immediately and can assure students that their FERPA-protected files are secure. Moving forward, we will continue to evaluate our privacy measures to ensure absolute protection of personal data.
Matt Hamilton
Registrar and Vice President for Enrollment and Student Financial Services.
Editor's note: Hamilton's letter indicates that The Daily's reporter is the only person who accessed personal files through the data breach, which is inaccurate. Four editors at The Daily who were notified about the breach were able to access personal files during the reporting stages, as well. The Daily has reached out to Hamilton and Press Secretary and Special Assistant to the President Matt Epting requesting information about how long personal files were accessible through Delve, how many student records were exposed and how the university will prevent similar issues in the future.
