The students whose information was exposed all took physics and astronomy courses under John Mottman, a professor at the university
So what, did he enter their SSNs along with their name in a grade spreadsheet? That seems overkill. Maybe if his classes are huge, something like this becomes necessary?
It had crossed my mind that giving professors listings of student names, addresses, and SSNs probably wasn't the best of ideas, not just because someone might lose the list off SSNs. I'm not so cynical to suspect nefariousness so widespread, but there are just so many profs, adjuncts, instructors, etc, that something bad was bound to happen. And it's so unnecessary. The good news is that it seems all schools are moving away from using the SSN as identification.