Stanford Business School officials are admitting that for years they have given steep price breaks to preferred applicants while claiming the scholarships were only for needy students — and say they will close a glitch that allowed public access to thousands of confidential student financial aid records.

A student discovered in February that the files were accessible to all business school students and employees, and informed the school about the vulnerability. He also downloaded the information and spent months studying financial aid data from 2008 to 2015. The result was a 378-page statistical analysis that revealed the difference between the school’s claim of fairly awarded scholarships and what it had actually been doing.

“All fellowships are need-based,” claims the school’s website, which was updated on Wednesday. Before then, the site included an assurance that the business school “does not offer merit-based scholarships.”

But it does discriminate — often favoring female applicants, international students, and those with backgrounds in finance, says the report by Adam Allcock, a Stanford business school student from the United Kingdom who found and analyzed the data. The school “represents its financial aid system to students as ‘non-merit-based,’ while operating it as ‘merit-based’ by secretly rating students and manually deciding how much (scholarship money) they should receive,” Allcock wrote in the analysis obtained by The Chronicle. He asked that the report not be shared publicly because he has returned the data to the school, which has not disputed its findings.

“Students with identical financial situations receive vastly different (scholarship) awards” despite being told that their grant is calculated solely on their need, says Allcock’s report. It says the school also tells applicants not to reveal to their classmates the size of their discount. Allcock concludes that the secret system harms students “who make tangible financial decisions on the basis of these representations.”

Jonathan Levin, dean of the business school, sent an email to employees and students on November 17 and said Allcock’s report “raises an issue we intend to address.”

Using the word “fellowship” to refer to financial aid scholarships, Levin acknowleged that the business school “has offered additional fellowship awards to candidates whose biographies make them particularly compelling and competitive in trying to attract a diverse class.” He said the school’s “communications over the years have explained the base level award process, but have not discussed the incremental fellowship awards.”

Levin vowed to be “significantly more transparent” about how awards are granted, but said it would take time to resolve the problem.

Kristin Harlan, a spokeswoman for the business school, declined to comment further.

Poets & Quants, an online news outlet focusing on graduate business education, broke the story of Allcock’s discovery and said that Stanford’s effort to entice students with financial backgrounds “suggests an admissions strategy that helps the school achieve the highest starting compensation packages of any MBA program in the world.” Its article said the Stanford business school sends a greater percentage of its graduates into lucrative private equity and venture capital jobs than other top business schools, including Harvard and Wharton.

Last year, 12 percent of Stanford MBA graduates were hired by private equity firms, with a median starting salary of $177,500, the article said. Venture capital companies hired 7 percent of them, and paid a median salary $167,500 to the beginners.

In his email, Levin appeared most concerned with the “breakdown in securing confidential data” and called it a serious problem. He said the students’ financial aid information has been accessible since at least June 2016, and that the business school has hired a data forensics firm to determine if other confidential files are also publicly accessible.

“We have taken steps to review the access settings of all our shared folders and correct any inappropriate settings that permit unintended access,” Levin wrote, noting that problem wasn’t the only recent breach of private information at Stanford.

Last month, the university notified more than 200 employees and alumni that confidential files — including information from personal counseling sessions they may have had — had been accessible to users from more than 50 other college campuses, according to an article in the Stanford Daily.

University officials hadn’t known of the problem until the student reporters told them about it.

“There is no excuse for this compromise of privacy and security, and I intend to do everything possible to ensure that it does not happen in the future,” Levin wrote in his email.

Allcock declined to be interviewed but shared an email he had sent to Levin and members of the business school in which he criticized Levin’s response as too tepid.

Nanette Asimov is a San Francisco Chronicle staff writer. Email: nasimov@sfchronicle.com Twitter: @NanetteAsimov