Southeastern Oklahoma State University is a public, four-year university located in Durant, Oklahoma. A data breach exposed student educational records (including names, contact information, Social Security numbers, grades, enrollment data, financial aid information, disciplinary records, and medical information contained in educational records). This breach violates the Family Educational Rights and Privacy Act (FERPA), the HIPAA Privacy Rule, and students' common-law privacy rights. The breach affected employee personal data and injury information, including employee name, date of birth, date of injury, as well as Social Security number, Medicare card, and child custody/consent status. More than 90,000 student names, Social Security numbers, and student identification numbers, as well as Forms 1095-C and more than 490 documents.