The New State Education Department (NYSED) announced a data breach occurred with its testing vendor Questar. WBFO's senior reporter Eileen Buckley says although it is a small breach one local Catholic school was affected.
“Questar told us that an unauthorized user accessed an account to view student data from December 30, 2017 through January 2, 2018.
State Education Commissioner MaryEllen Elia held a conference call late Thursday afternoon regarding the breach.
Only 52-students across the entire state at five schools were affected and it was isolated to students who took the state assessments on a computer in the spring of last year.
While the number is small, Elia said it is unacceptable.
“They told us that the breach includes personally identifiable information. Such information would be students’ names, their New York State student identification number or NYSUT number, the schools they attend, the grade level and their teachers’ names,” Elia explained.
Only one school in the Buffalo region was affected – St. Amelia School in Tonawanda. WBFO reached Catholic Schools Superintended of Diocese of Buffalo, Sr. Carol Cimino, who was notified by the state Education Department.
“Immediately up hanging up with the state Ed I did call Mr. Mulé. He’s the principal of St. Amelia’s just to alert him and there’s nothing he could do because state Ed now will contact Mr. Mulé, they will contact the student and they will contact the student’s parents. My question of state Ed was will they continue their business relationship with Questar? And the answer was it’s up to the commissioner,” said Sr. Cimino.
“Certainly we are going to hold Questar accountable and explore all avenues to do that. Certainly we need to make sure the provisions of the contract are held,” Elia stated.
Commissioner Elia said, at this point, Questar believes a former employee may be responsible.
A majority of the 28,000 students, who took the assessments, last spring used paper and pencil and were not affected.
Commissioner Elia said there does not appear to be any particular pattern of those 52-students targeted in the breach. But Elia said the information did not included social security numbers.
“This is not something you would know from looking at the pattern, but in our review of anything we have seen, we can’t say any reason that anyone would do it. But since it has been someone who was an employee there, they believe that, then I’m sure they are considering to investigate it. We are going to be very pro-active about it and very transparent about it, but we are going to move forward,” Elia noted.
The State Attorney General's office has been asked to investigate.
NYSED is requiring that Questar take immediate action to ensure no further data breaches occur including to:
- Force password resets on all user accounts and closing accounts of all former employees;
- Hire an independent third party to perform a security audit of Questar’s systems and security protocols, policies and procedures. Such security audit must be completed, and the results of such audit provided to SED, no later than February 20, 2018; and
- Submit a written corrective action plan to the Department no later than January 26, 2018, detailing the actions Questar has taken and will take to ensure that this does not occur again in the future.
Other schools affectedd by the breach at John F. Kennedy School in the Great Neck School District, Menands School in Menands, New York, School 2 in Oceanside and Public School #15 Jackie Robinson School in Queens.