Unfortunate news for Buena Vista University in BusinessWeek:

A northwestern Iowa university has reported a data breach on campus records which could include Social Security numbers of students and staff dating back to 1987.

Although the period is long the University claims it could affect fewer than 100K people. The question is what student and staff records system would keep SSN records going back 23 years? Tape backup? Were staff still identified only by their SSN in the financial system? Even in cases where records for minors must be retained that gives a maximum of 21 years for retention.