A software vendor ended up with some personal information dating back to 1996 for thousands of former and current Oregon State University students, the university announced. In some cases, the information included a person’s name and Social Security number.

In a letter to affected alumni, the university said it has since recovered the data and “severed our relationship with the vendor.” While the school has “no evidence that any individuals other than the vendor had access to your personal information, we are unable to guarantee that it has been secure.”

In the letter, the Corvallis, Ore. school said it is “readdressing our policy regarding vendor relationships and updating physical access controls on systems that process information of this nature.”

The school also said it “takes its responsibility to protect private information seriously and has been working diligently to limit the use and availability of sensitive information.”

Read more here.