Students at the University of Maine at Augusta could change grades and view confidential information through a school website after they were mistakenly given administrative access meant for faculty.
Students at the university on Thursday had access to the administrative controls of Brightspace, a website used by professors to teach online classes across the The University of Maine System. The issue was linked to a process the university system uses to synchronize information between Brightspace and a student information database, according to University of Maine System spokesperson Margaret Nagle.
The glitch gave them the ability to change their grades, and those of their classmates, and view closely guarded student identification numbers, though it’s not clear if any students took advantage of the error.
Internal emails from the University of Maine at Augusta obtained by the Bangor Daily News showed that the issue was “widespread” on Thursday, but Nagle denied that, saying it was “isolated” and that 242 unauthorized user accounts had access to the administrative controls, Nagle said.
Technology staff were initially made aware of the issue Thursday morning and had revoked unauthorized access by Friday, Nagle said.
The error also allowed students to see classmates’ identification numbers, which the University of Maine System uses to track students. The numbers are considered “confidential information,” a classification that marks some of the system’s most tightly controlled data that should be protected from third parties, according to University of Maine System policies.
“Confidential information may adversely affect individuals or the business of the University in the event of unauthorized access, use, disclosure, modification, loss or destruction; or is required to be kept confidential by regulation, statute, or other contractual confidentiality obligation such as with a third party,” according to a June 2021 letter from the University of Maine System’s chief information officer that outlined how different levels of information are meant to be treated.
Staff from the University of Maine System are still reviewing and tracking access logs to see if any students changed grades or used their unauthorized access, Nagle said. Any detected changes will be reversed, she said.
