JEFFERSON CITY, Mo. — It’s been one week since some Missouri teachers’ personal information was compromised, including social security.
That data breach is now under investigation, and the Missouri State Board of Education is discussing what needs to be done going forward.
Last week, the St. Louis Post-Dispatch said it notified the Department of Elementary and Secondary Education (DESE) after discovering a vulnerability on the department’s website that exposed personal information.
Gov. Mike Parson later called what happened a “hack” that could cost taxpayers millions.
“This administration is standing up against any and all perpetrators who attempt to steal personal information and harm to Missourians,” Parson said Thursday, two days after the Post-Dispatch notified DESE.
The data breach was a short topic of discussion at the Missouri State Board of Education’s monthly meeting Tuesday, one week after the department was notified.
“The department was made aware of a vulnerability in the data in our educator’s certification search tool,” DESE Commissioner Margie Vandeven said.
“DESE worked with OA-ITSD [Office of Administration Information Technology Services Division (OA-ITSD) to immediately shut down the took and we are working with ITSD to relaunch it with every certainty that the data are protected.”
The Post-Dispatch reported that more than 100,000 social security numbers were at risk. Vandeven told board members she wasn’t sure how long the investigation would take.
“Upon completion of the investigation, DESE will be able to share more and send additional communication to any and all educators impacted,” Vandeven said. “As we are under investigation, we are limited in the types of information we can provide.”
Parson said the investigation could cost taxpayers up to $50 million but board members did not point fingers at the newspaper Tuesday.
Democrats on the House Budget Committee announced Tuesday the $50 million cost will be used to provide credit monitoring services to the 100,000 educators affected and establish a call center.
Reps. Peter Merideth, D-St. Louis, and Kevin Windham, D-Hillsdale said they got the information from the governor’s office.
“During his tirade last week against the free press, Governor Parson strongly implied the state’s investigation and prosecution of a Post-Dispatch reporter would cost Missouri taxpayers $50 million,” Merideth said.
“Instead, Rep. Windham and I found that the loosely estimated cost was for funding efforts to provide credit monitoring for teachers put at risk by the state’s mistake — a much worthier endeavor than bullying a reporter who did the right thing by bringing this issue to light.”
Post-Dispatch Publisher Ian Caso said in a statement Thursday:
“We stand by our reporting and our reporter who did everything right. It’s regrettable the governor has chosen to deflect blame onto the journalists who uncovered the website’s problem and brought it to DESE’s attention.”
Parson said Thursday finding that data was more than just a right-click process.
“Through a multi-step process, an individual took the records of at least three educators and decoded the HTML code and viewed the social security number of those specific educators,” Parson said.
Board President Charlie Shields, CEO of Truman Medical Centers, said his hospital has experienced a data breach similar before.
“That’s the kind of world that we are living in and I think those challenges will increase,” Shields said. “Just like every other organization, we will continue to have to devote more and more resources to build that firewall against the challenges that are coming from the outside.”
Other members of the board, like Peter Herschend, agree, more resources are needed to protect important data.
“I think it is inevitable, people will find a way to do an end-run and that’s the continual job is to prevent that end run,” Herschend said.
Member Don Claycomb said he had been contacted asking what the state board was going to do about the breach.
“I clarified with that person that was not our direct control we had over that,” Claycomb said.
The state said once it knows the educators who were affected, they will contact the teachers and offer support. Officials suggest reviewing account statements and monitoring free credit reports, like those available at AnnualCreditReport.com.
The board also approved an emergency rule Tuesday, allowing substitute teachers to take an online 20-hour course through DESE sooner due to the shortage of substitute teachers.
“Staffing issues are real and they are challenging, so I think districts are at a point where they are doing everything they can think of and by the time it would go through at the end of December, we’re half a semester into the school year,” assistance commissioner at DESE Paul Katnik said.
Originally this additional option for certification was supposed to go into effect at the end of the year but due to the shortage, it will be available in early November.
“When you have a fill rate of around 60%, that means of all the subs requested I can only fill 6 out of 10, so the question is what’s happening with the other four rooms and that’s where the superintendents, principals are filling in, that’s where counselors are being pulled, that’s where teachers are getting more kids in their classroom or their planning time is being taken,” Katnik said.
DESE used this course from August last year through February and more than 4,000 individuals went through the program.
“Overwhelming districts said these folks do a great job and, in some instances, they are better prepared than the folks with 60 semester hours,” Katnik said.
The cost for the course is $180 and Katnik said it should be open in a week or two.