A data breach that impacted the city’s public schools may have also compromised the personal information of roughly 2 million current and former students across New York state, according to new data.
Over 500 schools were impacted by the January breach of software company Illuminate Education, according to a Friday report from THE Journal, an education trade publication.
Among those affected was the high-profile charter network Success Academy, that contracts with the software company whose services help schools track grades and attendance.
“There needs to be much more rigorous screening of use of these products,” said Leonie Haimson, co-chair of the Parent Coalition for Student Privacy, “and there has to be a real effort to minimize the data accessed by Illuminate — and all products — and the data deleted when it’s no longer used.”
State officials told The Post on Friday afternoon they were aware of 24 school districts and 18 charter schools impacted by the incident. They didn’t reveal how many schools within those districts were affected.
The state education department is surveying all districts and charters in New York about what, if any, Illuminate products have been used in the schools.
Hackers were able to gain access to students’ names, birthdays and ethnicities, as well as their English-learner, disability and free-lunch statuses, sources said in March when the breach was revealed in the city.
“Hopefully this will cause them to clean up their act, but I have no confidence that’s true,” Haimson said.
News of a possible privacy breach first broke when three Illuminate products widely used in New York City public schools — Skedula, Pupil Path and IO Classroom — went dark in January.
More than two months later, DOE officials accused Illuminate of failing to encrypt its systems.
On Friday, state officials said the education department was in touch with Illuminate to ensure they are working with school districts to notify impacted families. Charter schools, too, had connected with the software company.
“Success Academy informed all families of the data breach in late March, when we learned of it from Illuminate,” said Ann Powell, a spokesperson for Success Academy Charter Schools.
“Illuminate has informed us that it will notify affected families next week with details of the incident and will provide them with resources for how they monitor their personal data,” she said.
Illuminate Education in a statement to The Post confirmed those notifications were underway.
Meanwhile, Haimson, the student privacy advocate, suggested there’s been a “vacuum of information” or “contradictory information that has just made things worse.”
“We should not be finding this out from newspaper articles or trade journals,” she said. “There should be consistent messaging from the state and the city giving us updates on everything they know, and I don’t see that happening either.”