The Washington Post

Loudoun schools offer details on data breach

Loudoun County school officials offered a more detailed list Wednesday of the personal student and staff information that was publicly accessible online due to a security breach by a software vendor in late 2013.

Technology services staff combed through each of the 1,286 links that were left without password protection on an emergency management planning Web site maintained by contractor Risk Solutions International.

The links contained information from all 84 schools, according to a school system statement. Most schools uploaded “directory information” about students, including names, addresses, telephone numbers, date and place of birth, dates of attendance and course schedules.

Some schools posted additional information, including their evacuation plans, said Loudoun County schools spokesman Wayde B. Byard.

One school included locker combinations, and fewer than 10 schools posted parent contact information, he said. All schools likely included contact information, including cellphone numbers, for school administrators, Byard said.

Staff also combed through the site for any sensitive information that could be used for identity theft. According to the statement, there were no Social Security numbers, driver’s license numbers, financial accounts or credit card information included on the Web site. The site also did not have student grades or photos that could be used for identification.

Usually, the site is accessible only to authorized school personnel. But someone working on the site did not follow security protocols and left it online without password protection, officials said. The vendor identified three dates for when the breach could have occurred: Nov. 4, Dec. 19 or Dec. 24.

School officials said they could not determine how many of the links were discovered and opened. But they said they have no reason to believe that anyone accessed or used the data with malicious intent.

“The Web site was not hacked,” Byard said. “The information was left exposed; unfortunately, it was human error. That’s what led to this.”

Michael Alison Chandler writes about schools and families in the Washington region.



Success! Check your inbox for details. You might also like:

Please enter a valid email address

See all newsletters

Show Comments
Most Read



Success! Check your inbox for details.

See all newsletters

Your Three. Videos curated for you.
Play Videos
Making family dinnertime happen
Deaf banjo player teaches thousands
New limbs for Pakistani soldiers
Play Videos
A veteran finds healing on a dog sled
Learn to make this twice-baked cookie
How to prevent 'e-barrassment'
Play Videos
Syrian refugee: 'I’m committed to the power of music'
The art of tortilla-making
Michael Bolton's cinematic serenade to Detroit
Play Videos
Circus nuns: These sisters are no act
5 ways to raise girls to be leaders
Cool off with sno-balls, a New Orleans treat

To keep reading, please enter your email address.

You’ll also receive from The Washington Post:
  • A free 6-week digital subscription
  • Our daily newsletter in your inbox

Please enter a valid email address

I have read and agree to the Terms of Service and Privacy Policy.

Please indicate agreement.

Thank you.

Check your inbox. We’ve sent an email explaining how to set up an account and activate your free digital subscription.