University of East Anglia leaks confidential and highly sensitive student data in mass email

The University of East Anglia in Norwich has accidentally leaked confidential and highly sensitive personal information of dozens of students in a mass email to 320 other undergraduates. The email included a spreadsheet that listed 172 names and detailed extremely sensitive information about 42 students in the School of Art Media and American Studies (AMA) who applied for extenuating circumstances alongside their names and university ID numbers.

The extenuating circumstances included sexual assault, health issues, serious family illnesses and bereavements, depression and other mental health conditions.

The email was sent by a staff member's university email address on Friday, 16 June. A second email was sent shortly after apologising for the error.

"You may have erroneously received an email with a spreadsheet attachment. Could you please delete this without opening/reading. Thank-you very much," the second email read.

The university said Student Services was currently contacting all the affected students. UEA has also notified the Information Commissioner's Office (ICO) about the incident.

"This clearly should not have happened and the university apologises unreservedly," UEA said in a statement. "The university has launched an urgent enquiry and is offering support to everyone affected."

Megan Baynes, a 23-year-old American Literature and Creative Writing student, told the BBC that she was granted extensions for her coursework due to an illness suffered by a family member.

"I felt sick at seeing my personal situation written in a spreadsheet, and then seemingly sent to everyone on my course," she said. "My situation was not the worst on there but there are some on there that are so personal. There are people I know and I feel so awful for them and can't imagine how they are feeling."

UEA Students' Union education officer Theo Antoniou Phillips called the incident a "shocking and utterly unacceptable data breach that never should have happened".

"There are questions the university needs to answer both about this case itself and the antiquated systems that result in cases like this being logged on rudimentary Excel files in the first place," he added.

The union's welfare, community and diversity officer Jo Swo said: "Given the University is supposed to be making mental health a priority, this is a real slap in the face to students who have sought support."

Many students also took to social media to voice their outrage over the privacy breach.