Restriction.gif

The New York Times this morning reports that the test-preparatory company The Princeton Review accidentally published students' personal data and standardized test scores on its website. Information on at least 34,000 Florida students and 74,000 Virginia students was supposedly readily available to anyone accessing the company's website.

The information, which had been up for at least seven weeks, was found by a firm doing competitive research on The Princeton Review. It told the New York Times, who then contacted The Princeton Review, who immediately cut off access.

It appears that a site configuration flaw allowed "access to hundreds of files on the companyâ''s computer network, including educational materials and internal communications," according to the Times.

The Times said, "In addition to the information on students, the site contained the Princeton Reviewâ''s educational materials for the LSAT, PSAT and SAT exams, course schedules, an internal analysis of the effectiveness of the companyâ''s instructors, and the entire texts of some Princeton Review books, like the 2008 edition of 'Cracking the LSAT.' "

I wonder how much information was downloaded by the firm doing competitive analysis before it informed the Times about the security hole. I also wonder if any students found the hole, and also helped themselves to old exams and study guides.