Now facing possible criminal charges, the student's activities have been revealed as more extensive than originally believed.

After a similar incident last year and a major data breach in April, the university's "emergency response team" is now instating "corrective action."

Students who received the personal data were asked to delete it and empty the trash can folder in their email client.

Limited information — including names, birthdays and email addresses — has been compromised for an unknown number of school and university students.

A recent audit found the state's Education Department was storing sensitive personal data in plaintext format and not updating its software.

OSU officials say the data of 636 students, prospective students and family members was exposed to hackers engineering a phishing attack.

Though the education sector faces similar threats seen elsewhere, its challenge is balancing essential flexibility with sound security practices.

It's the second major security breach the university has seen in the past 12 months.

Inside cultures that are designed to be collaborative and open, IT leaders are struggling to corral their users and educate faculty on network risks.