A security blunder has left American students' personal details exposed