A University of Nebraska-Lincoln employee accidentally posted the Social Security numbers of 72 students, professors and staff members on the university's public Web site, where they remained for more than two years before UNL officials caught the gaffe Tuesday.
It's the second such security breach in the past year at UNL, twin mishaps that have a school vice chancellor vowing to tighten computer security.
Both times, student Social Security numbers sat unguarded on the Web site, accessible to anyone and easy prey for identity thieves.
"Absolutely, this is a big deal," said Christine Jackson, UNL vice chancellor for business and finance. "These sort of incidents aren't unprecedented, but they are surely unacceptable as well."
A man searching for someone at UNL typed that person's name into the university's online search engine and found the list of Social Security numbers.
He alerted the school Monday night, but that information didn't get to Jackson until Tuesday, she said.
The university immediately removed the Social Security numbers of the 66 students, four staff members and two professors from the Web site.
Jackson and a team of employees then began preparing to notify the group that their Social Security numbers had been posted on the Internet since the fall of 2004.
The affected UNL students and employees soon will receive letters explaining the situation. That letter will also direct them to a Web site that details how they can determine whether anyone has attempted to use their Social Security numbers.
It's the same process UNL followed in March, when the university discovered that the Social Security numbers, e-mail addresses and grade-point averages of 342 engineering students inadvertently were posted on the Web site.
On both occasions, information that was supposed to be stored on a secure part of the Web site was instead placed on the public part of the site.
Those errors happened even as the university was tightening its computer security, Jackson said.
For the past year, students have been issued a university ID number so they don't have to give out their Social Security number when taking a final exam or accessing their grades.
The university now uses Social Security numbers only when necessary, such as on tax forms, Jackson said.
The university also uses a computer program to periodically check its Web site for Social Security numbers, Jackson said.
Those periodic checks didn't uncover the 72 numbers because they didn't contain the twodashes usually found in Social Security numbers, she said.
"So there's no guarantee we'll always be able to catch all of them," Jackson said.