Bonnie Yankaskas, a highly regarded UNC cancer researcher, settled her dispute with the University today, agreeing to dismiss her appeal, provide the University with a full release of all claims — and leave the University no later than Dec. 31, officials said.
Yankaskas received a pay cut and demotion for her role in a 2007 hack that exposed the names, addresses and birth dates of women whose data were collected as part of the Carolina Mammography Registry.
In a joint statement, Yankaskas acknowledged her responsibility for the CMR, while the University acknowledged her as “an eminent researcher and a long-standing faculty member” and noted that a communication breakdown hindered her ability to realize that the CMR had a vulnerable server.
The University also agreed to pay Yankaskas $175,000 toward her legal fees, reinstate her as a full professor and rescind a 48 percent salary cut that reduced her annual pay from $178,000 to $93,000.
School of Medicine Office of Information Systems officials first alerted the University to the breach in July 2009 after uncovering a virus and potential security breach on the Carolina Mammography Registry’s FTP server. The breach exposed the personal information of about 180,000 subject and patient records.
As the registry’s principal investigator, Yankaskas was blamed for the breach, which also compromised about 114,000 Social Security numbers. She claimed that the University used her as a scapegoat for systemic data security weaknesses.
On Oct. 27, Yankaskas received an intention to discharge letter from Executive Vice Chancellor and Provost Bruce Carney, who said Yankaskas exhibited “deliberate neglect” in her oversight of the project’s data security.
“I was appalled,” Carney said in October. “The first question you have to ask is, ‘How does this happen?’”
