Correction: College only

LEWISTON – Personal information about recipients of the federal Perkins Loan program was accessible on the Bates College network only. The confidential information was not available on the Internet as indicated on Oct. 25. The information was incorrectly reported.

LEWISTON – A pair of documents on the Internet may have exposed more than 500 Bates College students to potential identity theft, the school newspaper reported Tuesday.

Sam Nagourney, a junior and managing news editor at the Bates Student, said the breach left personal information about recipients of the federal Perkins Loan accessible on the World Wide Web. All that was necessary to access that information was a Bates username and password.

“Anyone with that information could access it,” Nagourney said.

Then Managing News Editor Conor Hurley discovered the security lapse Oct. 13 while surfing the Bates network online.

“He was surfing around and he found these two files,” Nagourney said. “They may have been up there for six months.”

It was not known if any Bates students had experienced financial or other problems arising from the posted information.

“All that data was right there,” Hurley said. “It was laid out one row per name.”

Eugene Wiemers, vice president for information and library services, was investigating the matter. He said there was no indication that any student or alumni records had been accessed.

“We have no evidence that anyone tried to hack in,” Wiemers said.

As of Monday, the compromised information was no longer available on the Internet.

Wiemers said 508 student records were exposed. Most belonged to current students while others belonged to alumni, he said. Wiemers said an error by a staff member resulted in the posting. The Perkins Loan records, he said, were meant to be available only to the Bates financial office.

According to Nagourney, each recipient of the Perkins Loan had their address, date of birth, Social Security number and loan amounts posted on the Web.

Hurley said he advised school officials last week that personal information was posted on the Internet, yet no action was taken until Monday. Around the Bates College campus Tuesday, news about the breach was spreading fast.

“People are angry,” Hurley said. “They’re angry and upset.”

Bates officials contacted the loan recipients on Monday telling them that personal information might have been posted. They have since broadened the scope of the notification,

“Today, an e-mail was sent to the entire campus,” Nagourney said.

According to Wiemers, Bates policy as well as a 2006 law passed in Maine requires that school officials notify everyone whose personal data might have been accessed.

“We’re in the process of taking any additional steps we need to take,” Wiemers said. “I’m very grateful to the student who came forward with this information.”

Perkins funds are available to degree-seeking students who are enrolled in college and have established financial need. Maximum loans of $3,000 for undergraduate and $5,000 for graduate work may be obtained each year.