Student files exposed on Princeton Review's site

The Princeton Review, the test preparatory firm, accidentally published the personal data and standardized test scores of tens of thousands of Florida students on its website, where they were available for seven weeks.

A flaw in configuring the site allowed anyone to type in a relatively simple Web address and have unfettered access to hundreds of files on the company's computer network, including educational materials and internal communications.

Another test preparatory company said it stumbled on the files while doing competitive research and provided The New York Times with the Web address of the internal files on the condition that it not be named. The Princeton Review was informed of the problem yesterday, and the company promptly shut off access to that portion of its site.

The site contained information on about 34,000 students in the public schools in Sarasota, Fla., where the firm was hired to help measure students' academic progress. Another folder contained dozens of files with names and birth dates for 74,000 students in the school system of Fairfax County, Va., which had hired Princeton Review to measure and improve student performance.