A physics undergraduate, Owen Mitchem, inadvertently discovered and exploited a significant security vulnerability in the University of Oregon’s computer network. The flaw allowed him to access highly sensitive data, including the Social Security numbers of over 3,500 public university employees statewide, among them the university president and the football coach (the highest-paid public employee in Oregon). Despite Mitchem reporting the breach twice to university officials—intending it as a warning to strengthen cybersecurity—the institution responded by subjecting him to a disciplinary hearing instead of addressing the systemic weakness.The exposed data primarily involved internal employee records, raising concerns about identity theft, financial fraud, and reputational damage to the university. The incident highlights negligence in patching critical vulnerabilities, inadequate response protocols, and a culture of punishing ethical disclosure rather than incentivizing it. The breach did not involve ransomware or external malicious actors but stemmed from an unsecured network configuration, leaving confidential personnel data exposed to unauthorized access. The university’s failure to act proactively exacerbates risks of future exploits, legal liabilities, and erosion of trust among employees and the public.