Stanford U. official ousted after keeping quiet about huge exposure of sensitive data

The data exposure led to controversy about how the school said it dealt out financial aid versus how the process actually worked in practice.

The chief digital officer at Stanford University’s Graduate School of Business is out of a job after failing to disclose a data breach that included confidential student financial aid records and sensitive information from 10,000 employees.

Ranga Jayaraman served as CDO at Stanford for six years before stepping down Wednesday.

The breach was made public after a business school student found 14 terabytes of confidential student data from financial aid applications in February 2017 on an unspecified public server. Stanford business student Adam Allcock reported the breach and saw the records — some of which were a decade old — removed within an hour. Public disclosure only took place on Dec. 1 after Jayaraman originally had made the decision to not disclose the breach.

In an email to colleagues seen by the San Francisco Chronicle, Jayaraman took “full responsibility for the failure to recognize the scope and nature of the … data exposure and report it in a timely manner to the Dean and the University Information Security and Privacy Office.”

After discovering the data, Allcock wrote a 378-page analysis alleging that the business school lied about how it awarded financial aid. Instead of handing it out on the basis of student need, as the school originally claimed, aid went to “non-needy” students the school wanted to attract, the Chronicle reported. The school promised more transparency as a result.

The employee information included Social Security numbers, birth dates and salaries. Employee information was from 2008, and the student data was from a broader but unspecified range of dates, the Chronicle reported. The exposure began in September 2016 and lasted until February 2017. There is no evidence the information was accessed by a nefarious party.

The Stanford incident comes weeks after it was revealed that Uber paid $100,000 to cover up the breach of 57 million records of customers and employees. In addition to numerous lawsuits and the resignations and firings of numerous Uber security employees, that incident sparked fiery attention from Capitol Hill as well the introduction of a data notification law that would pin a five year prison sentence on individuals who conceal data breaches.

“We need a strong federal law in place to hold companies truly accountable for failing to safeguard data or inform consumers when that information has been stolen by hackers,” Sen. Bill Nelson, D-Fla., said in a statement. “Congress can either take action now to pass this long overdue bill or continue to kowtow to special interests who stand in the way of this commonsense proposal.  When it comes to doing what’s best for consumers, the choice is clear.”

Speaking to the San Francisco Chronicle, Jayaraman said he made the wrong choice in not disclosing the data exposure and would make a different choice today.

Update: The article previously attributed quotes to Allcock that were in fact stated by Stanford and SFGate.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure