Trend Micro researchers discovered and reported the eight-year-old defect to Microsoft six months ago. The company hasn’t made any commitments to patch or remediate the issue.

Other risk factors include age, where one lives and whether they use Gmail more frequently.

The effort failed to prioritize obvious strategies that would have generated higher engagement.

The data exposure led to controversy about how the school said it dealt out financial aid versus how the process actually worked in practice.