B2 BAY AREA NEWS GROUP 111
CYBERSECURITY
Data breach exposes Stanford students’ files Authorities identify man
By Patrick May and
Anna-Sofia Lesiv
Staff writers
For the second time in 15
months, Stanford Univer-
sity has been hit by an em-
barrassing data breach that
exposed the personal infor-
mation of students, includ-
ing home addresses, Social
Security numbers and even
test scores and essays.
The Stanford Daily is re-
porting that Stanford stu-
dents could view applica-
tions and high school tran-
scripts of other students “if
they first requested to view
their own admission docu-
ments under the Family Ed-
ucational Rights and Pri-
vacy Act (FERPA).”
Documents that were
compromised by the hack-
ers including extremely sen-
sitive personal information
like Social Security num-
bers for some students, as
well as “students’ ethnicity,
legacy status, home address,
citizenship status, crimi-
nal status, standardized
test scores, personal essays
and whether they applied
for financial aid. Official
standardized test score re-
ports were also accessible,”
the paper reported, which
explained that while stu-
dents’ documents could not
be searched by name, the
were “accessible by chang-
ing a numeric ID in a URL.”
“We regret this vulner-
ability in our system and
apologize to those whose re-
cords were inappropriately
viewed,” the school said in
Klay
Knows
• How important it is to stay informed
• How to focus his mind before a workday
• If you want to make an impact
it starts at the local level
a statement released Friday.
“We have worked to remedy
the situation as quickly as
possible and will continue
working to better protect
our systems and data. Find-
ing and fixing vulnerabili-
ties before adversaries dis-
cover and exploit them is an
ongoing and essential ac-
tivity in systems manage-
ment.”
The breach comes 14
months after Stanford an-
nounced that a previously
revealed hack of confiden-
tial information on a com-
puter server at its Gradu-
ate School of Business was
wider than had been re-
ported earlier, according
to Poets & Quants, a prom-
inent online news site that
covers the graduate busi-
ness school community.
In that hack, the site re-
ported, “campus privacy
investigators found that
a shared platform at the
GSB potentially exposed
the personal information”
of thousands of people at
the university. Like the re-
cent hack, the 2017 breach
compromised the personal
data of students, includ-
ing the “names, birthdates,
Social Security numbers
and salary information for
nearly 10,000 non-teach-
ing university employees
— a snapshot taken in Au-
gust 2008,” the report said.
“The file apparently was
made accessible to human
resources staff at the busi-
ness school for annual sal-
ary setting. The file was ex-
posed to the GSB commu-
er
nity for six months before
it was locked and secured”
in the spring of 2017.
The 2017 attack ended
up costing Stanford’s chief
digital officer his job. Ranga
Jayaraman announced
that he was leaving “after
a student revealed that the
school had not been forth-
coming with its fellow-
ship grants,” this newspa-
per reported at the time.
In a statement, Jayaraman
said, “I take full responsi-
bility for the failure to rec-
ognize the scope and nature
of the … data exposure and
report it in a timely manner
to the dean and the Univer-
sity Information Security
and Privacy Office. I would
like to express my most sin-
cere apologies … to anyone
whose personal informa-
tion might potentially have
been compromised.”
According to the Stan-
ford Daily, a student who
had submitted a FERPA
request in order to review
the student’s own admis-
sions documents discov-
ered “the vulnerability in
a third-party content man-
agement system called No-
lijWeb that the Univer-
sity has used since 2009 to
host scanned files.” Anyone
willing to submit such a re-
quest, going back to 2015,
would have been able to ex-
amine the files through No-
lijWeb. The Daily reported
that this student, between
Jan. 28 and 29, was able to
access the records of 81 stu-
dents.
Other students who were
Klay’s pregame ritual
is to read the paper.
Find out why at
KlayKnows.com
told about the easy-to-ac-
cess records were able to re-
view personal information
in 12 students’ records “dur-
ing that time period while
seeking to learn more about
the kinds of files exposed.”
Stanford’s IT department
on Feb. 5 learned from the
student newspaper that a
student had identified the
problem, according to the
university.
“University IT has since
disabled the vulnerable
component of the system
that was the source of the
problem,” the university
said. “As a result, the elec-
tronic delivery of applica-
tions and high school tran-
scripts to students who
request them has been sus-
pended, though students
may still make requests for
these documents to the Reg-
istrar’s Office. University IT
is researching options for
restoring the online access.”
Jonathan Lipman, a soph-
omore, told this newspaper:
“I’m glad the student who
first discovered the breach
acted morally and worked
to have the breach closed
before malicious actors
scraped all undergraduate
students’ admissions data.”
Sophomore Ben Esposito
said: “Stanford keeps run-
ning into trouble over data
breaches precisely because
it holds an unnecessary
large amount of data on its
students. If it held only the
most essential data, they
would be better able to pri-
oritize which data to keep
especially secure.”
SAN JOSE
stabbed to death at motel
By Jason Green
lice Sgt. En-
jason.green@
rique Garcia.
bayareanewsgroup.com Garcia said
Guerrero was
SAN JOSE » A man stabbed visiting Mar-
to death at the Palm Tree tinez in his
Inn Motel over the week- room when
end has been identified by Martinez Martinez at-
the Santa Clara County tacked him
Medical Examiner-Coro- and ran off.
ner’s Office as Adam Guer- Martinez was arrested
rero, 59, of San Jose. a short time later and
G u e r r e r o ’s death booked into the Santa
shocked childhood friend Clara County Main Jail on
Susana Lira. a murder charge.
“I called him brother Guerrero was taken to a
and he called me sister,” hospital and pronounced
said Lira, 58, of San Jose. dead a short time later,
“We had a strong bond.” according to Garcia. The
Lira said Guerrero suf- death marked the city’s
fered from health prob- sixth homicide of the year.
lems, but he still managed Anyone with informa-
to take her son to Game- tion about the homicide
Stop and do yardwork can contact Detective Sgt.
for her occasionally. She Jesus Mendoza or Detec-
couldn’t understand why tive Todd Jennings at 408-
anyone would want to hurt 277-5283.
or kill him. Those wishing to re-
“Adam was cool,” she main anonymous can
said. “He didn’t cause leave a tip with Silicon
problems.” Valley Crime Stoppers at
Robert Martinez, 47, is 408-947-STOP (7867) or
suspected of fatally stab- svcrimestoppers.org. Tip-
bing Guerrero on Saturday sters may be eligible for a
at the motel, at 2724 Mon- cash reward.
terey Road, where the two
lived in separate rooms, Contact Jason Green at
according to San Jose po- 408-920-5006.
Looking for the best coverage in the league?
Cam Inman • Dieter Kurtenbach
Jerry McDonald • Matt Schneidman
Catch them in your inbox by subscribing to
Raiders HQ & 49ers HQ
Visit mercurynews.com/raiders-hq
mercurynews.com/49ers-hq
Questions, comments & suggestions? Send them to
TheMerc@MercuryNews.com