ALBANY, N.Y. (NEWS10) – The New York State Education Department announced a breach of data by grades 3-8 assessment vendor Questar on Thursday.
The department says the breach affected a small number of students registered for computer-based training in spring 2017. A total of 52 students in five schools are affected.
The schools affected by the breach are:
# of Students Affected
John F. Kennedy School
Great Neck UFSD
PS 15 Jackie Robinson
NYC Geog District 29 Queens
St. Amelia School
Roman Catholic Buffalo Diocese
“While we are thankful this incident is isolated to only a small portion of students, any breach of data is unacceptable and we are holding Questar accountable,” Education Commissioner MaryEllen Elia said. “We have referred this matter to the Attorney General’s office for investigation. In addition, we have required that Questar take immediate corrective action to ensure this does not happen again.”
The Department is requiring that Questar take immediate action to ensure no further data breaches occur including to:
- Force password resets on all user accounts and closing accounts of all former employees;
- Hire an independent third party to perform a security audit of Questar’s systems and security protocols, policies, and procedures. Such security audit must be completed, and the results of such audit provided to SED, no later than February 20, 2018; and
- Submit a written corrective action plan to the Department no later than January 26, 2018, detailing the actions Questar has taken and will take to ensure that this does not occur again in the future.
Questar informed the department that an unauthorized user, whom the company believes is a former employee, accessed an internal Questar user account to view student data from December 30, 2017 to January 2, 2018. The data accessed includes personally identifiable information including student names, New York State Student Identification numbers, school, grade level and teacher names.
According to the department, it does not share student addresses and social security numbers with Questar and was not accessed by the unauthorized user.
The department has referred the matter to the New York State Attorney General’s Office for investigation.