Social Security numbers of more than 18,000 University of Virginia students were printed in the address field of health insurance brochures mailed this month to their homes, breaching the confidentiality of the personal information, the university said Thursday.
U-Va. spokesman McGregor McCance said a programming error in a university computer system initiated the problem with the brochures from Aetna Student Health.
The Social Security numbers were inadvertently included in an address file the university sent Aetna, which forwarded the information to a vendor that sent the brochures, McCance said. He said the error affected about 18,700 undergraduate and graduate students, including incoming first-year students.
The nine-digit numbers were not explicitly labeled as Social Security numbers, but they were printed directly above the names and addresses of students. Apparently no one at the university or Aetna spotted the problem before the brochures were mailed.
“We are very sorry this occurred,” McCance said. “We regret that it happened. The university takes matters regarding confidential information very seriously.”
The Cavalier Daily student newspaper and The Daily Progress of Charlottesville reported the breach Wednesday.
The brochures, which contained information about student health insurance options, were mailed July 3. McCance said the university learned of the problem eight days later. He said U-Va. would offer free credit monitoring for affected students to help them guard against any problems related to identity theft.
An Aetna spokeswoman, Cynthia Michener, said in an e-mail: “We regret that this unfortunate situation occurred. We have been working with the university to notify affected students and help ensure that an incident of this nature doesn’t happen again.”
Michener added that Aetna’s “standard protocol” with its vendor is to review samples before a mailing goes out. “That procedure was not followed in this circumstance,” she said.