Data Breaches | News

Virginia District Breach Caused by Risk Management Provider

• By Dian Schaffhauser
• 01/13/14

A Virginia school district is trying to explain to its community how a service provider could have allowed a data breach to occur. Loudon County Public Schools discovered the breach when a local newspaper contacted the district after hearing from a parent. Private information from all 84 of its schools was part of the breach.

According to reporting by Leesburg Today, the parent had missed a phone call from an unidentified number. When he did an online search on the number to find out where it had originated from, he also found results that led him to a Web page listing student and parent names, home addresses, phone numbers, and home room assignments. Also made public was the school system's emergency management plans. All of the personal information was being maintained by the vendor for emergency management purposes.

According to memos put out by the district, the security breach originated at a vendor site. The school system uses Risk Solutions International (RSI) to maintain its emergency plans. The company provides risk management services to clients in the education, business, government and nonprofit segments.

A frequently asked questions page explained that RSI employees had "engaged in technical testing on November 4, 2013, December 19, 2013, and December 24, 2013. Security protocols were not followed and the data was exposed." Since then, Risk Solutions had taken steps to shut its own servers and remove the data from cached servers at search engine companies. The site was never forcibly entered, the company reported. The site never lost its password security.

"Risk Solution International acknowledged that human error, on their part, was the cause of the data breach. I have insisted that they take all necessary steps to ensure the complete privacy of our data," said Superintendent Edgar Hatrick in a statement. "That said, I am deeply concerned that the breach occurred and have taken every possible precaution to make sure it does not happen again."