We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next.
The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a "lost card digit" that was incremented each time a card was lost (obviously mod 10 here).
So if my ID was 100000001, I went to school 002, had lost my card two times, my current card's Track 2 would say: 1000000010022
Needless to say there are tons of things that can be done here. From getting access to rooms does not, to getting free lunches.
Pretty interesting things. I told my school and they didn't really care at all (as expected). The potential loss from this is so low that it they didn't bother since abusing these issues would get you arrested and expelled pretty quick.
In reality, it is probably pretty serious. This student id is used somewhat as a School social security number. You can take tests as other students or impersonate other students in a lot of different situations.