Student data systems compromised in Hawaii, Tennessee

The personal information of thousands of students across Hawaii and Tennessee may have been compromised through a third-party vendor, regional and state education groups in both states announced this week.

The exposure was detected after a vendor called Graduation Alliance, an accredited online high school and data and web hosting service, experienced unauthorized access to its database last week, according to Brent Suyama, associate director of communications for the University of Hawaii.

The personal information of 70,000 K-12 students in Hawaii and an unidentified number in Tennessee is held by Graduation Alliance. The database contained students’ personal information, including names, ages, ethnicities and mailing addresses, as well as transcript and academic information.

Graduation Alliance has worked with more than 200 state agencies since 2007, and reports 43 states and 8 countries as clients for a litany of workforce and career-development services.

Because the database for the University of Hawaii system did not contain Social Security numbers, financial information or health records, the incident does not qualify as a security breach of personal information under Hawaii state law.

Law enforcement and cybersecurity firms in both states are currently investigating whether the data was compromised.

“We’ll be monitoring the investigation closely and will provide updates for students and their parents as information becomes available,” Tennessee Higher Education Commission executive director Mike Krause said in a statement. “We are working closely with law enforcement to ensure students’ privacy is protected.”

Higher education has struggled over the last few years to maintain effective cybersecurity, especially as student data becomes more readily available and distributed. Verizon’s Data breach investigations report found that the education industry experienced 292 cyber incidents in 2018 alone, resulting in 101 system breaches.

In Hawaii, Graduation Alliance was in charge of developing a statewide college and career-planning portal for those K-12 students called My Future Hawaii. The portal was intended to help students and counselors keep track of their progression and career interests before applying to the University of Hawaii, but it has since been taken offline, with all data transfers put on indefinite hold.

Hawaii’s Department of Education will send letters to the parents of affected students, according to P-20 Hawaii, a collaboration between Executive Office on Early Learning, Hawaii Department of Education and the University of Hawaii System overseeing the portal project.

Graduation Alliance was performing a similar duty in Tennessee, hosting and developing CollegeforTn.org, a career and college planning site. According to the state’s student assistance corporation, there’s no evidence that any data was withdrawn during the period of unauthorized access.