Honeoye Falls, N.Y. (WHAM) - The Honeoye Falls-Lima School District is working with the Monroe County Sheriff's Office to determine the extent to which data was exposed after an apparent hack of the superintendent's account.
According to the school district, a group of students is to blame for gaining access to student information.
School Superintendent Gene Mancuso said students used his own computer account. Mancuso said he’s not sure how the students got his password to access the district's internal SchoolTool system, but he believes he was an easy target.
“As a teenager, you think the superintendent might have a lot of authority over lots of things, but I can tell everyone else I really don’t have that much authority to change anything,” Mancuso said.
Sometime between August 1 and September 19, school leaders said the students used computers given to them by the district to hack into the school's directory accessing home addresses. It's unclear what they were trying to find.
“It's unfortunate,” Mancuso said. “We were able to teach a lesson, but at the same time computers are part of our world. Staff information and privacy is important and remains a priority.”
According to Mancuso, computers were handed out to students on September 17, and two days later staff members realized his account was used to access student records.
“I have a great team who are always looking out for our students first, but also the safety of all,” said Mancuso. “They recognize something wasn’t right and instead of sitting on it, they notified me immediately and we were able to take action.”
A security team determined no information was altered or leaked. District officials said they are "confident that no records were changed." They added that all staff network passwords were immediately changed after the fact.
Kaaren Anderson has a daughter in 10th grade at the district. She said a week ago she was notified via email from the superintendent about the incident and wasn't concerned.
“I would have guessed that if something was a breach of social security numbers or anything like that, he would have said something about that,” said Anderson. “I'm assuming it was mostly a prank as far as I could tell.”
Honeoye Falls-Lima High School senior Chelsea Moore said the incident made her a little uneasy.
“Honestly, it's kind of disrespectful,” she said. “I don't know if they saw any of our grades or whatever, but that stuff is kind of personal.”
Superintendent Mancuso would not specify how many students were impacted by the breach, nor would he say who was behind it. School leaders did say they were disciplined.
The school district is continuing to work with Monroe County Sheriff's deputies. In addition to the criminal investigation by the Monroe County Sheriff's Office, the HF-L district has launched its own investigation.
In a statement, the district’s public relations specialist Leah Shepard, said, “I can confirm that all staff members, students, and parents & guardians were notified the day the breach was detected. Also, as Superintendent Mancuso stated, the District is continuing to conduct a thorough review of the potentially affected records and information.”
According to deputies, the incident was filed on Sept. 19, and the computer network was secured immediately after the school discovered the breach.
Anyone who may have been directly affected or had their child's record affected or accessed will be notified by the district once the investigation is completed.