UConn bookstore sells drive holding personal data

University of Connecticut police are investigating how a hard drive containing personal documents and photos from about 10 students, faculty and non-university individuals was accidentally sold last week by the school's bookstore to a student on campus.

Ryan Green, a junior at UConn, in Storrs, Conn., said he purchased a 500GB Seagate Technology internal serial ATA drive for $200 on April 18 from the UConn Co-op on-campus bookstore. Green soon discovered the storage device contained three months' worth of copied folders, images and files from Macintosh and Windows PCs of at least 10 individuals.

"[The UConn Co-op] sold me a used hard drive as new and it retained people's data they had backed up," said Green. He said by scanning the hard drive's contents, it was "fairly easy to figure out whose computer" the data originated from.

According to Green, the drive's contents included an image of a college professor's computer as well as data from a current UConn female basketball play. The drive was handed over to campus police on the evening of April 18 and reviewed by investigators on April 21.

UConn Police Major Ron Bilcher confirmed that "significant amounts" of sensitive data and photos from the personal PCs of 10 people was contained on some 350GB of used space on the hard drive. "Certainly there was some identifying information for each and every individual on there," he noted. The affected individuals have been contacted by authorities, he added.

UConn police are still investigating the incident, but Bilcher said early indications point to an error by a Co-op employee who mistakenly put the hard drive up for sale. The 10 affected PCs were recently serviced or traded in at the Co-op store, he noted.

The UConn Co-op, a private entity that as the school's official bookstore, also sells computers, software and other supplies to students.

William Simpson, president and COO of the bookstore, said declined to discuss the circumstances surrounding the hard drive sale or the Co-op's backup policies pending the police investigation. "I can tell you that the UConn Co-op very much regrets that this has happened," he said. "Obviously we will be instituting more robust safeguards to prevent this type of thing from happening in the future."

Green said that the Co-op needs to do a better job of defining its data storage policies for people who entrust the store with their personal data. "I spoke with somebody that said they had the same [PC service] procedure done a few months ago, so the [sold hard drive] really hit home for her. She did not know they saved a copy of her data," he added.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.