Yale University Data Breach (2010)

On June 30, 2011, Yale was notified that an individual affiliated with Yale had searched his name on Google, and located and downloaded from a Yale hosted FTP server an electronic spreadsheet containing names and SSNs. Upon investigation, Yale concluded that the computer file had been stored for 10 months in a way that left the information in the file searchable using Google. Upon further investigation, Yale determined that the affected computer file was created in 1999 and was inadvertently moved to an insecure section of the computer server in July 2005. Although, from July 2005, the file was no longer fully protected from unauthorized public access, it could not be located using an ordinary internet search engine. The situation changed in September 2010, when Google modified its search engine in a way that allowed it to search files stored on servers like the one holding the affected Yale file. As a result, between September 2010 and July 1, 2011, it was possible that information in the affected file, including SSNs might have been located through a Google search.