San Diego School District Falls Victim to Massive Data Breach
More than half a million students, parents and staff members had their personal information exposed in a data breach in 2018.
- By Sydny Shepard
- January 03, 2019
More than 500,000 students, parents and staff members of San Diego Unified School District are dealing with the repercussions of having their data exposed in a breach that happened in 2018.
In December, San Diego Unified tweeted that an investigation led by their police and IT departments shined light on a breach that allowed an unauthorized user access to a district database.
The school district says it has notified all those who may have been affected via email.
The breach, which was discovered in October but could have happened any time before that in 2018, may have exposed a range of information including names, birth dates, addresses and Social Security numbers. Student information including schedules, disciplinary records and health details also could have been accessed.
The breached database also included parent and emergency contact information as well as staff member’s banking information plus payroll and benefit information.
San Diego Unified said the information dated back to the 2008-09 school year and encompassed more than half a million people. Even though the school district knew there had been a breach, they decided to wait until December to publicly announce it “to not immediately tip off those responsible that we were aware of their activities.”
The IT department believes the breach was made through a phishing scheme, in which victims are tricked into revealing confidential information through a deceptive email.
Tim Erlin, VP of Product Management at Tripwire, suggests setting up systems that allow you to have a complete understanding of who has been in your databases and can alert you when it sees a change.
“Phishing remains a major avenue for initial compromise. When planning security controls, it’s important to consider not only what an attacker might do, but also what an attacker with authorized access might do,” Erlin said. “In order to identify authorized, but malicious activity, it’s vitally important to have complete and comprehensive logs from all your systems. Detecting changes, and building a process for separating the good from the bad, can also be effective.”
Investigators are still trying to determine who is responsible for the breach.
About the Author
Sydny Shepard is the Executive Editor of Campus Security & Life Safety.