Minnetonka School District bounces back from email address breach in August
The Minnetonka School District makes an effort to stay up-to-date with technology. In the process of updating one of the systems the district uses this summer, however, workers inadvertently shared more than 2,000 personal parent email addresses with other parents in the district.
While the sharing of private information such as an email address is considered a breach, Minnetonka Schools Executive Director of Technology Mike Dronen urges parents not to worry. No passwords were shared.
The email sent to parents was in regards to a new single sign-on process parents will use this year, alerting them their email address on file would be used as their login.
The district has eliminated the script that failed to send individual emails to each parent instead of one mass email from their system, but some parents remain concerned about privacy.
Anne Taylor has two children in the Minnetonka School District and transferred to the district in 2011 from a private school. She said she’s had problems with the district since the very beginning, and that this email breach was yet another unfortunate event.
Back in 2011 when Taylor was enrolling her children in the district, she noticed upon logging into Skyward that there were two children who were not hers listed on her account. Skyward is a family-access website parents use to update family information and check student grades.
Taylor said she was able to see not only the children’s names, but also their vaccination records, dates of birth and even projected graduation dates.
When she inquired with the district what had happened, she was informed another Anne Taylor had previously begun to enroll her children in the district but never finished, and when Taylor came into the system the program linked the unfinished profile with Taylor’s new one.
Taylor said the district successfully removed the children, but that she continued to experience issues with Skyward.
As requested by her family’s emergency contacts listed on her Skyward account, Taylor did not supply email addresses for those contacts. Still, she said somehow their addresses appeared on the system without her consent.
Further, in investigating what happened with her Skyward account in 2011, Taylor said she asked if any other parents had seen data for children who were not theirs. She said she was told she “was not the only one,” but that the district now says it was an isolated incident.
Most recently, on Aug. 14, Taylor experienced her email address shared in what she referred to as a 90-page email listing more than 80 parent email addresses, the last of which was hers.
Taylor said she received a follow-up email a day or two later, informing parents their email address “may have been shared,” which led to more angst.
After all her attempts to work out her concerns with the school district, Taylor said she hasn’t received enough information about these incidents to rest easy.
“This piqued my interest back in 2011, and I have been very vigilant because of that experience,” Taylor said. “I don’t think the district is trying not to be transparent ... I just wish someone would be straight with me.”
In addition to Taylor’s data concerns, she also worries for her children’s privacy.
Taylor said her daughter takes surveys in school often, including the Northwest Evaluation Association survey administered twice yearly to help schools gauge student progress and placement, but that she doesn’t approve.
Taylor dislikes surveys for two reasons. She believes it is not a productive use of class time, and she does not want her daughters answers linked to her “record” for good. Taylor said data mining through surveys that her daughter takes on a computer via her student identification number can be tracked, which makes her uncomfortable.
Minnetonka Public Schools Executive Director of Communications Janet Swiecichowski said she and the rest of the district work hard to ease the minds of parents with privacy concerns like Taylor’s.
She said the email breach in August was an unfortunate side effect of switching systems and that the district responded “almost immediately” with an email to more than 10,000 district parents alerting them their email address may have been shared.
Swiecichowski said in that same email the district offered to allow parents to change their contact email address. Also, she said only 2,024 emails were shared, and that “no one got all 2,000 email addresses.”
Dronen said while the district regrets parent email addresses were shared with others in the district, there are positives to what happened.
“Nobody was trying to get our information,” Dronen said. “No passwords were shared, no other personal information was shared, and no one was trying to break into our system.”
In response to Taylor’s Skyward issue, Swiecichowski said it was an isolated incident. Dronen agreed, saying it was “an interesting set of circumstances that would be very hard to be produced again.”
Dronen also said he received fewer than 10 requests from parents asking to change their district email address.
In response to Taylor’s concerns about data mining and her child’s answers being linked to their “record,” Dronen said the district doesn’t link any answers to any individual student.
He said some parents have concerns about their children answering questions about sensitive issues such as drinking or drugs on surveys, and that they should know the school doesn’t track that information to individual students.
“If a student were to come in to school and say they were participating in a high-risk behavior, we would help them,” Dronen said. “But the district doesn’t do any data harvesting, and even if we had the time to do it, I don’t see what the value would be in that.”
Dronen said the company distributing the survey does keep the information and uses each students’ answers to illustrate patterns. He said this information is vital to school districts as it allows them to see where more attention or instruction is needed.
Additionally, Swiecichowski said without students anonymously answering questions about high-risk behaviors, the district wouldn’t have been able to form any of its helpful social programs, such as Tonka Cares, which aims to reduce substance use among Minnetonka students.
Swiecichowski and Dronen said they are still working with some parents who are concerned about data privacy.
“Data privacy is something we take very seriously,” Swiecichowski said. “Data breaches are so in the news right now that as we continue to rely on more digital tools we need to make sure securities are in place ... one of the very first things we teach students when they get their iPads is how to set up a password.
Protect your data
Dronen said the district makes a point to teach students how to be “responsible digital citizens.” He outlined some basic tips that he encourages both students and parents to take to heart when working with technology.
• Change your passwords often.
• Be thoughtful in how and where you store your passwords.
• For bank or other secure websites, have a different login than for less-secure websites.
• Be wary of public computers.
• Make sure to secure your Wi-Fi and that you use secure Wi-Fi.
• Carefully monitor spam.
• Be responsible with what you post on social media.
Dronen said if someone is too careless with passwords or uses the same login and password for every website, they are more likely to suffer a data breach.
Similarly, if someone were to post on Facebook that they are going on vacation, they are increasing the likelihood their home will be broken into in their absence.
In teaching Minnetonka students how to be responsible digital citizens following these tips – and stressing the importance of protecting their privacy on iPads – Dronen said students are learning lessons they can take with them into their adult life.
The Minnetonka School District has removed the script that erroneously shared more than 2,000 parent email addresses. Dronen also said this accident has allowed the district to talk about updating procedure if this should ever happen again in the future.
Taylor said she is still trying to work out her concerns about data privacy with the district. She said her family opted out of taking the survey and that she still believes surveys are a poor use of class time.
If you are a parent in the Minnetonka School District and are concerned about data privacy, contact firstname.lastname@example.org.
The Minnetonka School District also hosts Digital Citizenship classes. The next class is 6:30-8 p.m. Monday, Oct. 6, at Minnetonka High School, 18301 W. Hwy. 7, Minnetonka.
Contact Stephanie Gonyou at email@example.com