The University of Texas at San Antonio has posted a breach notice on the university’s site:
The University of Texas at San Antonio is informing 688 students and prospective students who either enrolled in or applied to courses in the Honors College that an unauthorized user may have gained access to information about them. Those affected have been notified by personal letter.
[…]
The data exposure was discovered Aug. 2 and information exposed included name, date of birth, address, phone number, email address, GPA and other personal information. No Social Security numbers were part of the information exposed. Within an hour of discovering the unauthorized access, UTSA officials addressed the issue and initiated an investigation.
Examination of the data exposure indicated its characteristics were not consistent with an attack designed to gather data from the system, but rather an inadvertent misconfiguration of assigned access to the information.
[…]
How did the data exposure occur?
On Aug. 2, an employee discovered that the ASAP online information system used by the UTSA Honors College and other UTSA offices was accessible by users who didn’t have a business need to access the application. The problem was resolved within an hour of discovery. The exposure was caused by a configuration error implemented June 20, allowing access to ASAP by all UTSA employees with ASAP access, rather than only authorized Honors College users. A thorough analysis and investigation of the incident determined that 233 records were accessed by unauthorized employees and 455 additional records may have been accessed.How many students’ records were exposed?
The records of 4,700 individuals who were either qualified for the Honors College or were Honors College alumni were exposed (open to access), but only 688 records were accessed. It was determined that 233 records were accessed by unauthorized users. An additional 455 records may have been accessed by unauthorized users; the remaining 4,012 records were not accessed.
Who was notified of the data exposure?
Read more on UTSA.
h/t, @eduinfosec