A contractor working with the Montgomery County school system has informed the parents of about 340 special-education students that the children’s private data was on a computer stolen during a break-in.
WestEd, a nonprofit research organization, acquired the student data from Montgomery County school officials as it conducted a review of special-education processes and procedures for a report that was issued in October.
WestEd officials say the data was on the hard drive of a laptop that was stolen Nov. 3, when intruders broke into the organization’s D.C. offices and carted off five computers.
The laptop was password-protected and kept in the locked desk drawer of an administrative assistant, said Max McConkey, WestEd’s chief policy and communications officer. The Montgomery data was included within two attachments on an email, he said.
There has been no sign of attempted access of the computer or misuse of the data, McConkey said. “We’ve never got any indication that anyone was attempting to guess the password or get in,” he said. “We would have been alerted.”
Montgomery County school officials said this week that they had expected a greater level of security for the information.
The data included parent and student names, addresses, phone numbers, students’ birth dates, school status, disability, race, home language spoken, mediation and hearing outcomes, most- recent individualized education program meeting date and type, and school enrollment information. No Social Security numbers were included.
The school system provided the data to WestEd to help identify parents to participate in a focus group or survey for the special-education study.
“We are frustrated with their carelessness toward our records,” said Montgomery schools spokesman Derek Turner.
Elise Cohen, a Rockville parent with two sons who receive special-education services in Montgomery, was dismayed about the possibility of a security problem, particularly for her teenager, who is developmentally and intellectually disabled. The family received two of the letters from the company about the data loss, one for each son, she said.
“We’re concerned about any debt that could be incurred in his name and any of the other permutations of identity theft,” she said.
WestEd officials said they did not immediately realize the student information was stolen with the laptop but discovered the loss as they conducted an investigation. Montgomery school officials say they were told of the problem Nov. 24. WestEd wrote a letter to parents that was finalized in late December and mailed Jan. 5.
Cohen said her family received the WestEd letters in early January. Another parent reported getting a letter in late January or early February, the parent’s lawyer said.
Some found the timing of the letters troubling.
“Why are families just finding out about it?” said Lyda Astrove, a longtime advocate for special-education students in Montgomery County. She also asked why the school system had not separately contacted families or made offers to pay for credit monitoring.
Astrove also questioned the handling of the data: “Why is the data still sitting around on somebody’s laptop when the report’s been finalized and handed in?”
WestEd officials have heard from three parents since the letters went out, they said. Some parents did not get letters from WestEd because although they may have participated in a focus group or survey, their information was not on the computer that was stolen.
The organization said work for the project was largely completed by late October, when staff began to wind it down. WestEd destroyed the data by the contract’s end, which McConkey said he thinks was Dec. 31.
In its letter, the research organization wrote: “WestEd sincerely apologizes that this laptop theft occurred. We are committed to protecting the privacy of students’ and parents’ personal information.”