Email nightmare for some FSU students

shieldI mentioned yesterday that sometimes people and software screw up in ways that cause problems. Today I saw an article demonstrating just how bad these issues can be. Florida State University Housing Department sent detailed and confidential violation reports to tens of thousands of students.

On Monday, March 14 at around 2 p.m., FSU first became aware that a glitch in the University Housing software caused the system to email approximately 13,195 current and former FSU students detailed incident reports of any and all code of conduct complaints associated with them, the FSView has learned. FSU News

In some cases, reports were of minor issues like halogen lights or open flames. But in other cases the violations were much more serious. These include reports of drug offenses, harassment and assault. Emails were only sent to the students associated with the report, but there is the possibility that some anonymous reporters were revealed by this glitch. Given some of the reports were more than 10 years old, it’s also possible these emails went to non-involved recipients.
As an email professional this type of glitch is horrifying. I can’t fathom what the glitch was. Whether it involved a human making a mistake or was triggered by the software, this is horrible design. No email containing sensitive and personal information should ever be sent unintentionally.
FSU reports they’ve stopped using the software. I hope they’ve unplugged it from any network completely. A little bit of poking at Google doesn’t tell me who the vendor is, although one of the major campus conduct software vendors (Maxient) has a note on their Facebook page that they are not the software used by FSU.
Like I said yesterday, stuff breaks online. The problem is some of these failures can cause problems and injury to real people. What happens online isn’t that separate from what happens offline these days. Our security needs to be better.

Related Posts

ESPs leaking email addresses

Two of my tagged email addresses started getting identical pharma spam over the weekend. It is annoying me because I am now getting spam in a mailbox that was previously spam free. The spam is overwhelming the real traffic and I am having to make some decisions about what to do with the email addresses and their associated accounts with the companies I gave them to.
One thing I did notice, though, is that both companies use iContact as their ESP. A cursory check of my other mailboxes shows that none of my other tagged addresses are mailed through iContact. I don’t think it’s very likely that these two individual, unrelated companies made deals with the same spammers to sell address lists at the same time. It’s much more likely that there was a compromise somewhere and address lists were stolen.
Edit: Checked my other account and, likewise, I’m getting the same spam to a 3rd address serviced by iContact. I’ve sent mail to all 3 companies involved and we’ll see how they react.
And, as I was thinking about this, iContact just laid off a bunch of staff about the same time they announced their partnership with Goodmail. Based on past history with companies in this situation, it seems possible this is a disgruntled former employee. I’ve also seen reports from other people noticing spam to addresses given to iContact customers.

Read More

Random thoughts on reporting abuse

stop_atOn IRC today, someone mentioned an Ars Technica article discussing how a research team tried to contact Xfinity about a security flaw in their home security system.

Read More

Is your data secure?

Not just secure from outside forces, but also secure from employees?
In a recent survey published by Help Net Security, approximately half of all employees said they would take data, including customer data, when leaving a job.
This has major implications for ESPs, where employees have access to customer data and mailing lists. There are at least 2 cases that I am aware of where employees have walked out of a company with customer mailing lists, and I’m sure there are other incidents.
ESPs should take action to prevent employees from stealing customer data.

Read More