University of Limerick confirms personal email addresses were disclosed in data breach

THE UNIVERSITY of Limerick has confirmed around 1,000 personal email addresses were inadvertently disclosed in an email which was circulated to prospective students.   

The data breach, which occurred last month, was swiftly dealt with by UL and reported to the relevant bodies. No other personal data was shared.

The incident occurred as a general information email was being sent out to some CAO applicants whose preferences included a UL course featuring elective modules.

The purpose of the email was to advise applicants to consider the options associated with their selected courses as they would need to decide about their elective/pathway if they secured a CAO offer for UL.

Work starts on 'landmark' mural at University of Limerick's city centre campus

A UL spokesperson said: “Unfortunately, the email was sent with applicant email addresses in the ‘to’ rather than the ‘BCC’ field. This is contrary to UL policy and occurred because of human error. No other personal data was contained in the email.”

The BCC field in an email allows you to send emails to multiple people without seeing who else it was sent to.

A statement from UL, issued to Limerick Live, said the error was quickly discovered and steps were taken to mitigate its impact.

“An email recall was issued. Another email was sent to the original recipients, apologising for the error and requesting them to delete the original email,” the statement said.

“The email relating to elective modules was re-sent to the applicants using the bcc function,” the statement continued.

Missing teenager who travelled to Limerick located 'safe and well'

UL also informed the CAO of the data breach and the CAO then advised those affected that they could change their registered email address if they wished.

“Since this incident, UL has reviewed its practices and has put in place a new process to communicate with applicants,” the spokesperson said.

“The University is committed to safeguarding all personal data with which it is entrusted, and all UL staff are required to complete data protection training. It is regrettable that this data breach occurred, and appropriate measures have been taken to prevent recurrence,” the spokesperson added.