JEFFERSON CITY, Mo.– “Beyond unethical” is what Gov. Mike Parson called a hack involving teacher and staff data on the Department of Elementary and Secondary Education’s (DESE) website. The department says at least three educators’ information was taken and they are working to identify others who may have been compromised.
“We will not let this crime against Missouri teachers go unpunished,” said Gov. Parson.
The state says it learned that personally identifiable information was potentially compromised on Oct. 12.
The Post- Dispatch reported Wednesday it discovered a vulnerability on the site that exposed personal information and alerted the states.
Officials say through a multi-step process, an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.
DESE notified the state’s Office of Administration Information Technology Services Division and the educator certification search tool was disabled.
These records were located within the educator certification data available on DESE’s website and were only accessible on an individual basis. The governor says this data was not freely available and had to be converted and decoded in order to be revealed. The state says it is unaware of any misuse of the information.
“We apologize to the hard-working Missouri teachers who now have to wonder if their personal information was compromised for pathetic political gain by what is supposed to be one of Missouri’s news outlets,” said Gov. Parson.
Parson didn’t name the media outlet but yesterday The St. Louis Post-Dispatch reported it discovered the vulnerability in a web application that allowed the public to search teacher certifications and credentials.
The paper reports DESE removed the affected pages Tuesday after The Post notified them of the breach. The paper says it delayed publishing the news to give the department time to take steps to protect the information.
Post-Dispatch Publisher Ian Caso said Thursday, “We stand by our reporting and our reporter who did everything right. It’s regrettable the governor has chosen to deflect blame onto the journalists who uncovered the website’s problem and brought it to DESE’s attention.”
The governor said not only will the state hold the person behind the hack accountable but also those who aided the person and the media corporation that employs him or her.
Gov. Parson said this incident alone may cost the state $50 million. He said the incident is also diverting workers and resources from other agencies.
He also said the Cole County prosecutor has been made aware of the hack and the Missouri Highway Patrol’s digital forensic unit is also involved.
Gov. Parson said the state is owning its part in the hack. He says the state is strengthening its security and is addressing areas where it can do better as well.
“We will not rest until we clearly understand the intentions and why they were targeting Missouri teachers,” said Gov. Parson.
Jason Roberts, President of Kansas City Federtion of Teachers issues this statement in response to the incident, “I find the details of the investigative reporting conducted by the St. Louis Post Dispatch to be troubling. The negligence on the part of the state and the Department of Elementary and Secondary Education is unacceptable. The Governor and the state need to act in a way that will ensure protection for school staff at all levels. This is unacceptable, and the Governor needs to own it!.”
The state says it is making every effort to contact the impacted educators. Officials suggest reviewing account statements and monitoring free credit reports, like those available at AnnualCreditReport.com.