Some college savers' info exposed online

Posted March 19, 2014

— More than 60,000 people who contribute to NC 529 college savings plans have had some of their personal information inadvertently revealed on a third-party website.

Two large data files available on the website of a Forsyth County tech company listed the names, addresses, and ages of tens of thousands of people who contributed to NC 529s, along with the name of the child who is the beneficiary of each account.

The files did not contain birth dates, Social Security numbers, any bank or financial information or any passwords or identifiers for the College Foundation of North Carolina site.

The North Carolina State Educational Assistance Authority oversees the plans, and Director Steve Brooks was informed of the problem Tuesday evening by WRAL News.

Brooks said the problem apparently occurred during the development of the group's new NC 529 scholarship drawing – a promotion designed to encourage contributions to 529 plans.

"The good news is our servers were never compromised. Nobody got access to anyone's account, nor did they get access to any financial information," Brooks said. "We don't have any reason to believe anyone is at risk for identity theft." 

"It's a really unfortunate occurrence," Brooks added. 

NCSEAA was working with Cassels, Caywood and Love, a Winston-Salem marketing company – Brooks says they've worked with the firm for 20 years – and some of the programming work was outsourced to ThinkVents and a related firm, Inner Eye.

According to Brooks, ThinkVents and Inner Eye were working on the scholarship contest website. The contractor provided them with files of names and addresses of current NC 529 account holders so that those people would automatically be entered into the drawing.

The data files were on the subcontractor's staging server and should have been removed after the development stage but were not, he said. The downloadable files were apparently available for at least two weeks.

"It shouldn’t have ever been in a place where it was accessible on the web, but it was," Brooks said, "It's our responsibility that it was out there."

ThinkVents owner Robert Chapman did not respond to a message from WRAL News late Tuesday, but someone at the firm removed the information from the website shortly after receiving an.inquiry. 

The data that was exposed doesn’t legally constitute a breach of privacy under state or federal law, Brooks said, but NCSEAA will still notify all account holders Wednesday by email, alerting them to the issue.

"We’re going to try to find out exactly how this happened, but we’re confident it was not malicious," he said. "Still, it's a violation of our privacy policy, and we’re distressed about that."


This blog post is closed for comments.

Oldest First
View all
  • whatelseisnew Mar 21, 2014

    "The contractor provided them with files of names and addresses of current NC 529 account holders so that those people would automatically be entered into the drawing."

    If that act was not a crime, then it should be a crime. Also folks, why are you bothering saving. Here is what you do. At age 16 rent your child an apartment so they can establish a separate address from you. Have them work part time. At age 18 they can fill out a fasfa and get a sort of a free ride on the backs of taxpayers. I say sort of because once they start working after college they will be paying for the next set of kids.

  • c1555258 Mar 20, 2014

    View quoted thread


    I just called to express my disappointment with CFNC and THINKVENT, the third party vendor that is primarily to blame.

  • Pseudonym Mar 19, 2014

    CFNC's website is just plain AWFUL. There is no simple link on the front page that says "MAKE A PAYMENT". Now this? What in the world are they doing with all that $$ I'm paying them in interest???

  • ConservativeVoter Mar 19, 2014

    View quoted thread

    All NC 529C customers with College Foundation are affected by this whether or not they use the internet or not.

  • lewiskr45 Mar 19, 2014

    View quoted thread

    If you don't want a company sharing your information, purposefully or not, with a third party, don't use the internet.

  • glarg Mar 19, 2014

    View quoted thread

    I hate to be the bearer of bad news but google "IRA withdrawal college" or check IRS publication 970. If we are talking about a traditional IRA here is what it says:
    "However, you can take distributions from your IRAs for qualified higher education expenses without having to pay the 10% additional tax. You may owe income tax on at least part of the amount distributed, but you may not have to pay the 10% additional tax. "

    "Additional tax" is the 10% penalty. You still owe tax on the distribution on whatever your tax rate is.

    And the IRA money is counted into your AGI

  • dh1964 Mar 19, 2014

    View quoted thread

    You might take your own advice, Libertarian. There are lots of similar pages out there, but this is from a Wells Fargo article titled “Tapping Retirement Funds to Pay for College”:
    [i]Financial planners don't consider it a great idea, but parents can now tap into IRAs to help pay for college.
    Rules … have been amended to allow withdrawals for qualified higher education expenses. The money can go toward college for you, your children, or grandchildren.
    The main benefit: Assuming you're under the age of 59½, you won't have to pay a 10% penalty ... You will have to pay taxes on the distribution, but the rules are different depending on what kind of account you're accessing. With the traditional IRA, the full amount of the withdrawal will be taxed when you're under 59½, assuming all your contributions were made on a pre-tax basis. If you have made after-tax contributions to your IRA, a formula is applied to determine the taxable por

  • ConservativeVoter Mar 19, 2014

    View quoted thread

    To discourage them from sharing our information from other third parties.

  • dh1964 Mar 19, 2014

    View quoted thread

    Why? What would you like them to do at this point?

  • A Libertarian Mar 19, 2014

    Glarg - IRA distribution for education is not taxable. Educate yourself or ask your local public school for a refund!