A former Chico State employee who allegedly used access credentials to expose and publish the personal information of roughly 130 students who requested exemptions from the university’s COVID-19 mandate planned to leave his position before the incident occurred. The Orion originally reported that the employee had been terminated.

“He is no longer an employee of the University and is facing criminal prosecution,” Chico State President Gayle Hutchinson said in an Oct. 5 email. 

Sean Murphy, media relations coordinator for the university, released a statement to The Orion clarifying the former employee’s status:

“The employee’s departure from the University was unrelated to the data exposure. Additionally, the employee had planned to leave prior to the University learning about the data exposure. I’m concerned that your headline and the correction at the bottom of your story suggest that the employee resigned as a result of the data exposure.”

The data breach was allegedly published on the Internet by the employee, then allegedly shared by a Chico State faculty member with the media.

The Sacramento Bee broke the story on Aug. 23, the first day of classes.

“I’m disappointed that a faculty member put our students’ confidential data at further risk, which violates student confidentiality under the Family Educational Rights and Privacy Act,” Hutchinson said. “The University is addressing this incident with the faculty member.”

Butte County District Attorney Mike Ramsey confirmed to The Orion that his office is investigating the data breach with University Police for possible prosecution. The Orion also reached out to the FBI’s Sacramento field office but did not receive a response by press time. 

Kimberly Morales can be reached at [email protected] or on Twitter @kimberlymnews.

CORRECTION: Chico State has clarified Hutchinson’s original statement to note that “the employee’s departure from the university was unrelated to the data breach.” The Orion originally reported that the employee was fired.