System vulnerability at US university may have exposed student data