Applying for college involves a mountain of data -- GPAs, ACTs, SATs, essays, the list goes on. But NBC 5 Investigates found there are nine numbers students are routinely asked for that they do not have to offer up during the preliminary admissions process, and some experts say they should refuse to include -- their Social Security Number.
River Forest college student Maddie Schimmel recently received a startling letter in the mail from a university she applied to, but never attended.
"I didn't expect to hear from Butler University after not going to Butler," Schimmel told NBC 5 Investigates.
The letter, sent to 163,000 people affiliated with Butler University in Indianapolis, outlined a security breach which snared the personal information of current and past students, employees-, and even students who applied there but never stepped foot on campus.
"I was surprised I was still in their system, too, because I didn't need to be. So I don't know why they still had my information," Schmimmel said.
NBC 5 Investigates heard from other students who got the letter, including a 27-year-old college graduate who applied to Butler nine years ago.
Why Butler, and other colleges, even ask for SSN's during the initial admissions process may be the larger question at play.
"The truth is that you don't need to put your Social Security Number on your college application until, generally speaking, months later, after you apply for financial aid," according to Rob Franek, Princeton Review Senior Vice-President and the author of several best-selling college guides.
But it is hard for students to ignore any requested field on an application.
"Most kids feel if there is a field question on their application, they should likely fill it out," Franek said.
Franek is hoping schools stop asking for it during the preliminary admissions process.
The security of students and alumni is a growing area of concern in higher education, and many schools have already tightened security methods. Recent breaches at the University of Maryland, Indiana University and the University of North Dakota are just a few examples of breaches that affect now more than a million people nationwide.
For its part, Butler offered an identity protection plan to all of those affected. The school says it does not yet have a number of how many victims are taking them up on the offer, as they have until Sept. 1, 2014 to opt in.
A Butler spokesperson says the school is currently reviewing all of its admission protocols and will announce changes "in the near future."
