"The Norwegian Agency for Shared Services in Education and Research, SIKT, fixed the vulnerability shortly after it was discovered. It may have been applicable to a number of educational institutions as early as 2010", says Kai Tore Bakke, acting pro-rector for education at INN University.
INN University has had a close dialogue with SIKT ever since the matter became known. INN University has also chosen to notify the Norwegian Data Protection Authority.
"We have no evidence to suggest that unauthorized persons have gained access to data, but have chosen to notify about the suspicion because the vulnerability has existed for a long time, and a large number of students have used Studentweb during the relevant period", says Kai Tore Bakke.
Informing students
INN University has now issued information about the case to reach both current and former students.
The full notice from INN University reads:
Possible unauthorized access to student information
We are contacting you because a technical vulnerability in Studentweb and associated services at our supplier SIKT may have allowed unauthorized access to student information in the period from 2010 until the error was recently corrected.
Due to the lack of logs going back in time, SIKT cannot say for sure whether the vulnerability has been exploited, but they state that there are no indications that this has happened. The University of Inland Norway nevertheless assumes that information that is normally processed in Studentweb may be affected, such as contact information, study rights, education plan, exam results, documents from the document archive and local login information for studentweb.
There is nothing that you, as a current or former student, need to do as a result of this incident, beyond following the general advice you can find at https://www.sikresiden.no/en.
We have reported the incident to the Data Protection Authority and continue to follow up on the matter with SIKT to clarify the cause, scope and necessary measures. If you have any questions about this incident, please contact our data protection officer at personvern@inn.no.