Personal information of 52 NY students exposed in hack

A data breach at testing vendor Questar Assessment exposed personal information of about 52 students in five New York schools, state Education Commissioner MaryEllen Elia said Thursday.

Questar, headquartered in Apple Valley, Minnesota, reported that a former employee is suspected of using an internal account to view student names and other “personally identifiable” information from Dec. 30 to Jan. 2, according to Elia. She said company officials told her that one other state also was affected but did not know which one.

Questar did not immediately return a phone call seeking comment.

New York Attorney General Eric Schneiderman’s office has opened an investigation, spokeswoman Amy Spitalnick said.

Elia said the state first learned of the breach on Tuesday but was not told the names or schools of those affected until Thursday. The accessed data included some student names, identification numbers, grade levels and teachers’ names, but not student addresses, social security numbers, disability status or test scores.

The affected students, who represent a small fraction of students who took computer-based tests this past spring, attended five schools: John F. Kennedy School, Great Neck; Menands School, Menands; School 2, Oceanside; Public School 15 Jackie Robinson, Queens, and St. Amelia School, Buffalo.

On a conference call with reporters, Elia said she could not speculate on the reason the data was accessed, but said it would have no obvious use.

“We can’t see any reason that anyone would do it,” she said.

The department wants Questar to detail by Jan. 26 what steps it will take to prevent future breaches and to have an outside expert audit the security of its systems, security protocols and procedures by Feb. 20.

New York replaced test vendor Pearson with Questar in 2015 amid a backlash over standardized testing. The five-year, $44 million contract tasked Questar with developing new grade 3-8 English language arts and math assessments that districts could choose to administer via computer.

About 28,000 students took the assessments electronically this past spring, while an additional 60,000 students field-tested computer-based tests, Elia said. Although the majority of students in the state’s nearly 700 school districts still take the tests with paper and pencil, eventually all testing is expected to shift to computers.

“Any breach of student data, no matter how small, is unacceptable,” said Carl Korn, spokesman for New York State United Teachers, a statewide teachers’ union. “While it appears the State Education Department caught this quickly and responded appropriately, it underscores the serious concerns that parents and teachers have about the state’s rush to adopt computer-based testing.”