US education software company Frontline Education has confirmed that the cyberattack of 14 and 15 August also affected student data, not only employee data as first announced. Depending on the person, names, addresses, dates of birth, Social Security numbers, Medicaid numbers and student ID numbers were exposed. The attack involved the Frontline Central and School Health Management platforms and exploited a flaw in third-party software. The company, which serves more than 10,000 educational organisations, began notifying those affected around 26 October.

What it means: The case carries two lessons. The first is about concentration: when thousands of schools use the same platform, a flaw at one provider exposes data from many organisations at once, none of which had any control over what happened. The second is about timing: the attack took place in August, the first notice spoke of employees, and confirmation about students came two months later. Children's data is especially sensitive, because identity misuse can go unnoticed for years, until the child applies for a first loan or card. In Greece, schools, tutoring centres and education software companies that handle pupils' details fall under the GDPR, which requires notifying the Data Protection Authority within 72 hours of becoming aware of a breach. Anyone choosing platforms for schools should ask where data is stored, which fields are truly necessary and how parents will be informed if there is an incident. Data minimisation, meaning not collecting ID numbers when they are not needed, is the most effective protection.

Read the original on Frontline Education

Related service: Custom software

Related stories