My SSN was exposed at Columbia – a school I’m not affiliated with

I asked the College Board if this theory could be true. A spokesperson argued that every student’s SSN would have been shared by Columbia through a login program called “Student Search.” Before 2018, when SSNs stopped being shared entirely, the College Board determined that the “only time” it would share my SSN was if I requested to have my SATs taken at Columbia, which I never did.

My frustration grew over four months, until I emailed Columbia enough times that it agreed to tell me what was going on.

Columbia failed to delete the SSN database

Columbia had previously been criticized for taking almost a week to notify people who had broken the rules, because every day they don’t know increases the risk of theft. But for victims who were not connected to the school, the information took longer because, as the university explained, more time was needed to trace their contacts.

I don’t know when Columbia tried to contact me. A February letter sent to my father’s address—where I hadn’t been since high school—said that Columbia had “revealed” its wrongdoing to me, even though it was the first time it had told me. On Reddit, some users reported that they also received notification letters to their parents’ addresses. Others said Columbia was able to get their addresses.

In an interview with Ars, a university official said that before 2012, Columbia received student information, including Social Security numbers, from various sources. During that time, student enrollment services, academic programs, and experimental programs often shared SSNs with Columbia, possibly with the students’ permission.

A student may agree to share their SSN, the official said, in order to receive information about various schools or academic programs. Or they can directly ask the testing program to share their SSN and personal information. Ars reached out to the College Board and ACT, which operates the two major college testing programs, and confirmed that both have stopped sharing SSNs as student identifiers. The College Board ended the practice in 2018, and the ACT said it stopped nearly a decade ago.