SUNY Empire's social media footprint was exposed in two distinct ways, each capable of generating an institutional incident on its own. Both existed because social media platforms provide no native tools for institutional-level governance or automated content moderation.

‍

1. Access governance had never been centralized.

Fifteen users held varying roles across accounts: administrators, analysts, editors, some active, some dormant for months. Former employees retained credentials. An external advertising agency held access to paid accounts through passwords that had never been rotated.

On shared-credential platforms like Instagram, any individual who had ever received the password still had it.

On permission-based platforms like Facebook, access ran through personal employee accounts, meaning a compromise of any single personal profile could expose the university's pages, ad spend, and audience data.

There was no consolidated view of this access landscape.

2. Comment sections were being used to target students.

SUNY Empire's social engagement strategy centers on authentic storytelling, featuring real students by name and likeness. As the university's paid and organic presence grew, comment sections under enrollment ads became a recurring source of hostile content: appearance-based attacks targeting the students featured, hate speech, and accounts posting what appeared to be spam or phishing links.

‍