Cybersecurity Policy Report, GAO: Data Breaches Affect Thousands of K-12 Students, (Oct 15, 2020)
Thousands of K-12 students had personal information exposed in 99 data breaches from July 2016 to May 2020, the Government Accountability Office reported today.
"Students’ academic records, including assessment scores and special education records, were the most commonly compromised type of information (58 breaches). Records containing students’ personally identifiable information (PII), such as Social Security numbers, were the second most commonly compromised type of information (36 breaches)," GAO said.
"Financial and cybersecurity experts say some PII can be sold on the black market and can cause students significant financial harm. Breaches were either accidental or intentional, although sometimes the intent was unknown, with school staff, students, and cyber criminals among those responsible. Staff were responsible for most of the accidental breaches (21 of 25), and students were responsible for most of the intentional breaches (27 of 52), most frequently to change grades," it said.
GAO gathered information for the report from the K-12 Cybersecurity Resource Center (CRC). "Experts and federal agency officials agree that CRC is the most complete resource that tracks K-12 cybersecurity incidents, including student data breaches," it said.
GAO noted that the COVID-19 pandemic had intensified policy-makers’ focus on the security and privacy of educational technology that was being newly employed by students learning remotely. The report didn’t offer any recommendations. It was done at the request of Rep. Virginia Foxx (R., N.C.), ranking member of the House Education and Labor Committee.
News: FederalLegislation DataBreach