A routine security audit at the school found that a hacker had accessed a server used by its Burnaby Student Health Services Medical Clinic. The medical records stored on the server contained contact information and medical data of students who visited the clinic, BCIT said in a statement.
The records on the server date from October 2005 to June 2012 and include the following personal information: name, date of birth, medical services plan number, personal health number, phone number, address, treatment billing codes and descriptions.
BCIT said it took the server off-line when the breach was discovered and informed the Office of the Information and Privacy Commissioner for British Columbia about the incident.
The school stressed that there is no evidence that the information has been misused; the only unauthorized activity appears to be the uploading and downloading of movies on the server.
“BCIT sincerely regrets and apologizes for this incident. Please be assured we are taking immediate steps to address the situation and are reviewing our physical, technical and administrative information security processes”, the school said.