Loudoun County school officials offered a more detailed list Wednesday of the personal student and staff information that was publicly accessible online due to a security breach by a software vendor in late 2013.
Technology services staff combed through each of the 1,286 links that were left without password protection on an emergency management planning Web site maintained by contractor Risk Solutions International.
The links contained information from all 84 schools, according to a school system statement. Most schools uploaded “directory information” about students, including names, addresses, telephone numbers, date and place of birth, dates of attendance and course schedules.
Some schools posted additional information, including their evacuation plans, said Loudoun County schools spokesman Wayde B. Byard.
One school included locker combinations, and fewer than 10 schools posted parent contact information, he said. All schools likely included contact information, including cellphone numbers, for school administrators, Byard said.
Staff also combed through the site for any sensitive information that could be used for identity theft. According to the statement, there were no Social Security numbers, driver’s license numbers, financial accounts or credit card information included on the Web site. The site also did not have student grades or photos that could be used for identification.
Usually, the site is accessible only to authorized school personnel. But someone working on the site did not follow security protocols and left it online without password protection, officials said. The vendor identified three dates for when the breach could have occurred: Nov. 4, Dec. 19 or Dec. 24.
School officials said they could not determine how many of the links were discovered and opened. But they said they have no reason to believe that anyone accessed or used the data with malicious intent.
“The Web site was not hacked,” Byard said. “The information was left exposed; unfortunately, it was human error. That’s what led to this.”