Tag: breach

  • L.A. Schools Telehealth Vendor Waited 8 Months to Report Breach – The 74

    L.A. Schools Telehealth Vendor Waited 8 Months to Report Breach – The 74

    School (in)Security is our biweekly briefing on the latest school safety news, vetted by Mark Keierleber. Subscribe here.

    It’s another hot summer Friday and another day with news about a data breach — this one jeopardizing both student health and campus safety data.

    And once again, the development is unfolding in the country’s second-largest school district.

    Kokomo Solutions, which the Los Angeles district contracts with to provide telehealth services to students during the school day and to track campus safety threats, disclosed a data breach after it discovered an “unauthorized third party” on its computer network. The discovery happened in December 2024, but the notice to the California attorney general’s office wasn’t made until Aug. 5.  

    It’s the latest in a series of data privacy incidents affecting L.A. schools, including a high-profile 2022 ransomware attack exposing students’ sensitive mental health records and last year’s collapse of a much-lauded $6 million artificial intelligence chatbot project. 

    In the news

    Students at the center of Trump’s D.C. police takeover: In an unprecedented federal power grab, the Trump administration’s seizure of the D.C. police department and National Guard deployment is designed to target several vulnerable groups — including kids. | NPR

    • The move comes at a time when crime in the nation’s capital is on the decline. But a deep-dive from June explores how the district’s failure to prevent student absences has contributed to “the biggest youth crime surge in a generation.” | The Washington Post
    • Here’s what young people have to say about Trump’s D.C. takeover. | NBC 4
    • City police will roll out a youth-specific curfew Friday in the Navy Yard neighborhood. | Fox 5

    A new Ohio law requires school districts to implement basic cybersecurity measures in response to heightened cyberattacks. What the law doesn’t do, however, is provide any money to carry out the new mandate. | WBNS 

    News in Trump’s immigration crackdown: A federal judge in Minnesota has released from immigration detention a nursing 25-year-old mother, allowing her to return to her children as her case works its way through the court. | The Minnesota Star Tribune 

    • The Trump administration has revived one of its most controversial immigration policies from the president’s first term: Separating families. | The New York Times
    • Federal immigration officials quizzed an Idaho school resource officer about an unaccompanied migrant student, part of a broader national effort to conduct “welfare checks” on immigrant youth who came to the U.S. without their parents. | InvestigateWest
    • Leading Oklahoma Republican lawmakers have partnered with the Trump administration in a lawsuit challenging a state law allowing undocumented students to receive in-state college tuition. | InsideHigherEd
    • Los Angeles community members have organized to create protective perimeters around the city’s campuses after immigration agents reportedly drew their guns on a student outside a high school. | Los Angeles Times
      • The district announced new bus routes designed to improve student safety while commuting to school during heightened immigration enforcement. | NBC 4
    • The nonprofit Southwest Key, which for years has been the federal government’s largest provider of shelters for unaccompanied migrant children, has laid off thousands in Texas and Arizona after losing federal grants. The Trump administration dropped a lawsuit in March over allegations the nonprofit subjected migrant children to widespread sexual abuse. | ABC 15
    • A Texas court blocked the state attorney general’s request to depose and question a nun who leads Catholic Charities of the Rio Grande Valley, one of the largest migrant aid groups in the region. | The Texas Tribune
    Sign-up for the School (in)Security newsletter.

    Get the most critical news and information about students’ rights, safety and well-being delivered straight to your inbox.

    Microphone-equipped sensors installed in school bathrooms to crack down on student vaping could be hacked, researchers revealed, and turned into secret listening devices. | Wired

    ‘These are innocent children, sir’: New video of the delayed police response to the 2022 mass school shooting in Uvalde, Texas, shows the campus police chief attempting to negotiate with the gunman for more than 30 minutes. | The New York Times

    Kansas schools have become the latest target in the Trump administration’s campaign against districts that permit transgender students to participate in school athletics. | KCTV

    • The Loudoun County, Virginia, school board has refused to comply with an Education Department order to end a policy allowing transgender students to use restroom facilities that match their gender identity. | LoudounNow 
    • The Education Department’s Office for Civil Rights has opened an investigation into allegations the Baltimore school district ignored antisemetic harassment by students and educators. | The Baltimore Banner

    Lots of drills — little evidence: A congressionally mandated report finds that active shooter drills vary widely across the country — making it difficult to understand their effect on mental and emotional health. | National Academies of Sciences, Engineering, and Medicine

    A federal judge has blocked a new Arkansas law requiring that public schools display the Ten Commandments in all classrooms. It’s the second state Ten Commandments law to be halted this year. | Axios 

    ICYMI: I did a deep-dive into the far-right Christian nationalists behind more than two dozen state Ten Commandments-in-schools bills nationally — each of which are inherently identical. | The 74

    Is Texas up next? Civil rights groups will ask a judge on Friday to prevent a similar law from going into effect. | Houston Chronicle

    ICYMI @The74

    Despite Court Order, Education Department’s Civil Rights Staff Still On Leave

    ‘So Many Threats to Kids’: ICE Fear Grips Los Angeles at Start of New School Year

    Emotional Support

    Don’t sleep on this Bloomberg feature into “Doodlemania” — the billion-dollar industry for hypoallergenic (and floofy!) designer pups.


    Get stories like these delivered straight to your inbox. Sign up for The 74 Newsletter

    Source link

  • Data breach reporting lags in education, study finds

    Data breach reporting lags in education, study finds

    This audio is auto-generated. Please let us know if you have feedback.

    Dive Brief:

    • It took the education sector 4.8 months on average to report data breaches following ransomware attacks between 2018 and 2025, according to a report released last week by Comparitech.
    • Colleges and schools had the highest average reporting time for ransomware data breaches when compared to the business, government and healthcare sectors, Comparitech found in its analysis of over 2,600 U.S. ransomware attacks. 
    • At the same time, education companies — counted separately from colleges and schools — saw even higher reporting times at 6.3 months. Waiting months to disclose a data breach is dangerous, given that stolen data can be on the dark web before victims even know a breach happened, wrote the researchers for Comparitech, a cybersecurity and online privacy product review website.

    Dive Insight:

    Delayed reporting of data breaches comes at a time when schools and ed tech companies alike are grappling with the ongoing threat of ransomware attacks.

    Illustrating the prolonged response times for ransomware breaches, the latest Comparitech report pointed to Texas’ Alvin Independent School District confirming just this month that a June 2024 data breach impacted nearly 48,000 people. The data involved names, Social Security numbers, credit and debit card numbers, financial account information, medical and health insurance information, and state-issued IDs. 

    Organizations often wait to disclose a data breach because they are unsure if data was stolen following a ransomware attack until the hacker posts the stolen information on the dark web, Comparitech said. 

    “Data theft is a common component of ransomware attacks, so it’s not unreasonable for companies to assume hackers stole data, even if there isn’t any evidence to suggest data theft at first,” researchers wrote. “The worst thing to do is to jump to the conclusion that data hasn’t been stolen.”

    The FBI also advises against paying threat actors following a ransomware attack. If organizations pay a ransom, it still doesn’t guarantee any data will be recovered, the agency’s website states, adding that ransom payments can actually encourage more attacks.

    K-12 school districts have been especially concerned about a widespread breach of student and staff data across North America following a December 2024 ransomware attack on ed tech provider PowerSchool. 

    Though PowerSchool disclosed the cybersecurity incident about a week later, the company allegedly told districts not to worry about sensitive student and staff information being exposed. Five months later, however, PowerSchool publicly confirmed that, despite paying a ransom to threat actors, multiple school districts were being extorted with the same information stolen in the December incident.

    Since then, over 100 school districts — including Tennessee’s largest school system, Memphis-Shelby County Schools — have sued PowerSchool for negligence, breach of contract and false advertising.

    Source link

  • PowerSchool data breach leads to school extortion attempts

    PowerSchool data breach leads to school extortion attempts

    This audio is auto-generated. Please let us know if you have feedback.

    Dive Brief:

    • Threat actors are trying to extort some public schools by threatening them with teacher and student information stolen in a December 2024 data breach of PowerSchool’s Student Information System, according to recent statements from the ed tech software provider and the North Carolina Department of Public Instruction. 
    • PowerSchool confirmed on Wednesday that it paid a ransom to threat actors shortly after the Dec. 28, 2024, data breach. The company added that it believes the threat actors seeking ransoms from schools are using the same compromised data set from the December incident, which included student and staff names, contact information, some Social Security numbers, medical notes and a limited number of passwords. 
    • While PowerSchool’s December data breach appeared to impact a wide range of school districts across North America, a spokesperson on Friday told K-12 Dive that the threat actors have only contacted four school districts. Schools in locations ranging from North Carolina to Toronto began to report receiving such ransom threats this week. 

    Dive Insight:

    For years, the FBI has advised schools and other organizations not to pay ransomware demands, because doing so can embolden threat actors and there’s no guarantee that stolen data will be recovered.

    PowerSchool acknowledged in a Wednesday statement that it made a “very difficult decision” to pay a ransom after the December 2024 incident. The company said it thought paying a ransom was the best option for preventing the data from going public. 

    “In the days following our discovery of the December 2024 incident, we made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve,” PowerSchool said. “As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us.”

    A PowerSchool spokesperson said the company is not disclosing how much it paid to the threat actor. 

    Meanwhile in North Carolina, the state’s education department pointed out in a Wednesday statement that PowerSchool had assured its customers five months ago that the data compromised in the December 2024 data breach was not shared and had been destroyed. 

    “Unfortunately, that has proven to be incorrect,” the North Carolina Department of Public Instruction said. “PowerSchool is the party responsible for the breach. There is nothing NCDPI, school districts or individual schools could have done to prevent these violations.”

    The state education department added that it will not engage with the threat actors and that doing so would violate North Carolina law.

    Additionally, the department said the incident appears to be a global cybersecurity incident impacting customers in multiple states and Canada. An FBI investigation into the matter is ongoing, according to NCDPI.

    PowerSchool is working directly with the contacted schools and law enforcement, the company’s spokesperson said. The company is also providing free credit monitoring and identity protection services to students and staff. 

    Public pushback against PowerSchool since it announced the initial data breach in January has included multiple class action lawsuits. The company serves over 60 million students and 18,000 educational customers.

    The data breach occurred after a threat actor gained unauthorized access to an unknown amount of student and staff data by infiltrating the company’s PowerSource customer support portal for district and school staff. PowerSchool previously confirmed to K-12 Dive that the same system lacked multifactor authentication — a standard and encouraged practice for securing sensitive data.

    Source link

  • Data breach affects 10,000 Western Sydney University students – Campus Review

    Data breach affects 10,000 Western Sydney University students – Campus Review

    Students from Western Sydney University (WSU) have had their data accessed and likely posted to the dark web in a data breach event.

    Please login below to view content or subscribe now.

    Membership Login

    Source link