South Washington County Schools is investigating after a student gained access to electronic personnel data.
The district notified all of its roughly 3,250 employees last week that it discovered the data breach and was investigating with the help of law enforcement and a computer forensic firm.
While it does not appear files were compromised beyond the student’s unauthorized access, the notice was sent to all employees “out of an abundance of caution,” communications director Barb Brown said.
“We are working as expediently as possible to complete our investigation and will be issuing a final investigatory report soon,” she said. “Further, we will be notifying who was actually included in the data once that becomes known.”
State law prohibits the district from releasing any information about the student, but Woodbury police, who are conducting the parallel investigation, confirmed that it was a Woodbury High School student.
The district’s preliminary investigation indicated the student was acting alone and did not disclose data to others or attempt to benefit financially from the information.
The student is cooperating with the investigations, police and the district said.
The district first contacted police Jan. 4 to report unauthorized computer access, Woodbury police public information officer Michelle Okada said.
Superintendent Keith Jacobus sent an email to all district employees Jan. 13. The message told employees they should check their credit report for any accounts they did not open or suspicious creditor inquiries. It provided credit bureau contacts for any employees concerned about fraud.
“I understand that you may be concerned and frustrated about this matter,” Jacobus wrote. “I share your frustration and regret that this situation has occurred. The district strives to maintain all private and confidential data in a secure manner.”
Jacobus also said the district is reviewing its security measures and enhancing them.
If the investigation shows the student disclosed or attempted to use the data in any way, the district will make identity theft protection services available to affected employees at no cost for a year, Brown said.