Poor astronomy security

Apparently 3,000 students at California Polytechnic State University are endanger of having their social security numbers used for identity theft. These stories aren't uncommon, but then I read:

The students whose information was exposed all took physics and astronomy courses under John Mottman, a professor at the university

So what, did he enter their SSNs along with their name in a grade spreadsheet? That seems overkill. Maybe if his classes are huge, something like this becomes necessary?

It had crossed my mind that giving professors listings of student names, addresses, and SSNs probably wasn't the best of ideas, not just because someone might lose the list off SSNs. I'm not so cynical to suspect nefariousness so widespread, but there are just so many profs, adjuncts, instructors, etc, that something bad was bound to happen. And it's so unnecessary. The good news is that it seems all schools are moving away from using the SSN as identification.