How did data breach that claimed 23,000 passwords occur? Paterson school district has almost no answers.
By Jayed Rahman
Published: June 3, 2019
More than three weeks after the Paterson Public Schools learned about a massive data breach that occurred eight months earlier, school officials still have no explanation on how more than 23,000 passwords were stolen.
Superintendent Eileen Shafer in a statement three weeks ago had said the district’s information technology (IT) officials were investigating the breach. On Wednesday, the Paterson Times sent a series of questions seeking answers on whether the school system has determined how the breach occurred and whether the perpetrator snatched any files or documents from school computers.
Paul Brubaker, spokesman for the Paterson Public Schools, did not respond to the email seeking answers.
“Nothing on how it happened, but the board has given the approval to bring in a security analyst to find out,” said school board member Kenneth Simmons, chairman of the technology committee, when asked if the district provided an explanation to the Board of Education on how the breach occurred.
Three weeks ago, Shafer said a former employee could have taken the passwords that were eight months old. However, the perpetrator had said he or she had access to the district’s system last month.
Shafer’s administration has been downplaying the data breach. For example, in a press release last month, Brubaker claimed the report of the data breach was “unfounded.” Shafer and her team were provided incontrovertible evidence of the data breach last month.
Her administration has denied multiple requests to interview district IT officials. The school system has a 22-person IT department that costs the district $1.6 million a year
Shafer’s administration has taken steps to secure its systems after learning about the data breach. For example, the district reset all email passwords. It also instituted a two-factor authentication process for employees.
The breach included desktop logins, laptop credentials, and network passwords. The district has not said whether those passwords have been changed.
School officials said the district also instituted a whitelist that blocks all non-recognized internet protocol (IP) addresses from accessing the district’s systems.
Email: [email protected]