One state official said the distribution of a spreadsheet by the company's lobbyists represented a "significant" data breach.

The company revised its story last week, but it's still not saying which universities were affected by the cyberattack discovered last May.

Now facing possible criminal charges, the student's activities have been revealed as more extensive than originally believed.

After a similar incident last year and a major data breach in April, the university's "emergency response team" is now instating "corrective action."

Students who received the personal data were asked to delete it and empty the trash can folder in their email client.

Limited information — including names, birthdays and email addresses — has been compromised for an unknown number of school and university students.

A recent audit found the state's Education Department was storing sensitive personal data in plaintext format and not updating its software.

OSU officials say the data of 636 students, prospective students and family members was exposed to hackers engineering a phishing attack.

Though the education sector faces similar threats seen elsewhere, its challenge is balancing essential flexibility with sound security practices.