University of North Carolina at Charlotte

The University of North Carolina at Charlotte experienced a significant data breach in May 2012, as reported by the Iowa Attorney General’s Office. The incident stemmed from incorrect access settings, which exposed financial account numbers and approximately 350,000 Social Security numbers of individuals associated with the university. The breach compromised highly sensitive personal and financial data, posing severe risks of identity theft, financial fraud, and long-term reputational harm to the institution. The university responded by notifying all affected individuals and offering data recovery services to mitigate potential damages. However, the scale of the breach—particularly the exposure of Social Security numbers—indicates a large-scale compromise of personal information, which could lead to prolonged legal, financial, and operational repercussions. Such breaches often erode trust among students, faculty, and partners, while also inviting regulatory scrutiny and potential penalties for failing to secure critical data. The nature of the exposed data (financial and SSNs) suggests the breach had direct consequences for individuals’ privacy and security, aligning with severe impact categories where customer or employee data leaks result in substantial harm. The university’s proactive notification and recovery efforts, while necessary, do not fully offset the severity of the exposure or the long-term risks faced by those affected.

Source: https://www.iowaattorneygeneral.gov/for-consumers/security-breach-notifications/2012-security-breach-notifications/

TPRM report: https://www.rankiteo.com/company/unc-charlotte-college-of-computing-and-informatics

"id": "unc802082025",
"linkid": "unc-charlotte-college-of-computing-and-informatics",
"type": "Breach",
"date": "5/2012",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '350,000 (individuals with '
                                              'exposed SSNs)',
                        'industry': 'Higher Education',
                        'location': 'Charlotte, North Carolina, USA',
                        'name': 'University of North Carolina at Charlotte',
                        'type': 'Educational Institution'}],
 'customer_advisories': ['Notifications sent to affected individuals'],
 'data_breach': {'number_of_records_exposed': '350,000 (SSNs) + unspecified '
                                              '(financial accounts)',
                 'personally_identifiable_information': 'Yes (SSNs)',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Financial account numbers',
                                              'Social Security numbers']},
 'date_publicly_disclosed': '2012-05-09',
 'description': "The Iowa Attorney General's Office reported a data breach "
                'involving the University of North Carolina at Charlotte on '
                'May 9, 2012. The breach exposed financial account numbers and '
                'approximately 350,000 social security numbers due to '
                'incorrect access settings. The University has notified '
                'affected individuals and is providing data recovery services.',
 'impact': {'data_compromised': ['Financial account numbers',
                                 'Social Security numbers (~350,000)'],
            'identity_theft_risk': 'High (due to SSN exposure)',
            'payment_information_risk': 'High (financial account numbers '
                                        'exposed)'},
 'post_incident_analysis': {'root_causes': 'Incorrect access settings leading '
                                           'to unauthorized exposure of '
                                           'sensitive data'},
 'references': [{'source': "Iowa Attorney General's Office"}],
 'regulatory_compliance': {'regulatory_notifications': ['Iowa Attorney '
                                                        "General's Office"]},
 'response': {'remediation_measures': ['Notifying affected individuals',
                                       'Providing data recovery services']},
 'title': 'University of North Carolina at Charlotte Data Breach (2012)',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Incorrect access settings'}