Isabella Diaz-Mira | Managing Photo Editor

Until recently, anyone with a WashU email address, including every WashU student, was only a few clicks away from accessing hundreds of sensitive internal University documents. 

The documents, which were accessible via a simple search of the University OneDrive, included emergency response protocols for WILD and commencement events, confidential profiles of donors with personal information, contracts with outside vendors, IT incident reports, clinical trial memos, and more.

Student Life notified the University that the documents were available on Thursday, Oct. 29, after which many files were taken down. The Office of Information Technology (WashU IT) released an email on Oct. 30 titled “Privacy Changes in Microsoft Teams, OneDrive, and SharePoint,” announcing, “Teams will now be set to Private instead of Public (visible to everyone at WashU).”

Publication of this article was delayed by five days to allow the University time to fix the issue. 

Kedra Tolson, associate vice chancellor for University communications, referred Student Life to Jen Stedelin, interim vice chancellor and chief information officer of WashU IT, who provided a written statement to Student Life confirming that a review of OneDrive procedures and systems was underway. 

“The university is conducting a broader internal review to better understand the circumstances and scope of the access issue and determine whether additional security measures are necessary,” Stedelin wrote. “We continue to review our systems and practices to strengthen information security, consistent with our highest responsibility to protect the sensitive information entrusted to us.”

Exposed files date back to 2009, while others were created and being updated through October 2026. Some documents have been exposed since at least summer 2026. According to WashU IT’s website, all current WashU students, faculty, and staff have access to OneDrive’s file storage. Students’ OneDrive accounts deactivate 24 hours after their graduation.

Many of the documents were stored in “shared libraries,” a OneDrive feature that allows various team members to work on shared documents. Titles of available shared libraries included “Contract Management,” and “Major Incidents and Significant Events,” created by WashU IT. According to Microsoft’s website, when shared libraries are set to public, everyone in the organization has access to them. 

Annamaria Szakonyi, cybersecurity expert and assistant professor of information systems at Embry Riddle Aeronautical University, said accidental oversharing is a “common challenge” across large systems. However, she noted that she does not have direct knowledge of WashU’s systems or the incident in question. 

“Tools within Microsoft 365 (like search or Copilot) are designed to make files easily discoverable across an organization,” she wrote in an email to Student Life. “If a folder containing sensitive operational files is set to internal public visibility, those documents will automatically surface in search results for anyone logged into a university account.”

One such shared library titled “2026 ThurtenE and Reunion Weekend” contained a safety and security document with a disclaimer on its first page that read: “Public disclosure of this plan has the potential to significantly compromise public safety.” 

Additional shared libraries shared by WashU Emergency Management contained the security plans for other major campus events, such as 2024 Commencement and 2026 WILD.  

Kate Westfall | Managing Design Editor

Another shared library contained records of thousands of outside contracts with software, laboratory, medical, and custodial service providers, and the payments made by WashU for their services. 

Szakonyi wrote that the exposure of emergency plans could cause serious harm to event attendees, while unauthorized access to other documents could provide an opening for hackers.

“Detailed donor profiles, vendor contracts, and IT incident logs provide rich context for malicious actors to conduct highly targeted social engineering, such as spear-phishing or business email compromise (BEC) attacks,” she wrote.

Other spreadsheets linked to the WashU School of Medicine included staff’s cell numbers and current rotational assignments, including their location within the hospital during certain hours and procedure schedules. There was at least one spreadsheet containing drug orders. An email detailing a clinical trial follow-up was also available. 

An available document titled “Sidechat Report” in a folder made by WashU IT recorded student-made Sidechat posts about IT and printing services. Sidechat is an anonymous social media platform exclusive to users with WashU emails that is primarily used by students. The document rated each post as positive, negative, or neutral in sentiment. The IT folder also contained records of major security breaches of WashU systems, including a 2024 CloudStrike outage and the 2026 Canvas hack.

Several folders created by University Advancement — WashU’s fundraising arm — contained planning documents for campaigns, including private donor information. Many profiles were labeled “confidential” at the top. They included personal cell numbers, home addresses, and birth dates of donors, as well as biographies detailing the donors’ careers, families, philanthropic involvements, and previous interactions with University Advancement and senior university leadership. 

Some of these documents also reported a “research capacity,” or WashU’s estimated range of what these individuals could donate based on their financial position. Alongside the donor profiles were travel agendas, including flight reservations and the hotel rooms of administrators and others attending fundraising events across the country. 

There were also files created by individual students, faculty, and staff. These included many student group projects and presentations. Several spreadsheets for specific classes, which included students’ names, their WashU ID numbers, and grades for assignments, were available. Student Life reviewed at least one completed W-9 tax form, including an employer identification number. 

Szakonyi advised those worried about their personal information to wait for communication from University leadership on whether their information was exposed to unauthorized parties. She also advised practicing “good cyber hygiene.”

“This could mean rotating passwords, utilizing a password manager, ensuring Multi-Factor Authentication (MFA) is enabled on all work and personal accounts, and remaining vigilant against unexpected emails or phishing attempts,” Szakonyi wrote.