Student Medical Records Exposed After LAUSD Breach

1 year ago AndyC

On
Feb.
22,
the
education
news
site
The
74
Million
revealed
that
the
hacking
group
Vice
Society
had
posted
hundreds,
if
not
thousands,
of

On
Feb.
22,
the
education
news
site
The
74
Million
revealed
that
the
hacking
group
Vice
Society
had
posted
hundreds,
if
not
thousands,
of

psychological
evaluations
of
special
education
students
in
the
Los
Angeles
Unified
School
District
(LAUSD).

The
leaked
information
reportedly
includes
personal
information
like
names,
diagnoses,
family
immigration
status,
and
allegations
of
physical
and
sexual
abuse.

Since
The
74’s
story,
the
official

@LASchools
Twitter
account
has
sent
messages
about
Dream
Act
applications,
Anti-Bullying
Day,
and
Eva
Longoria.
The
account
of

LAUSD
Superintendent
Alberto
Carvalho
has
tweeted
about
school
building
improvements,
Narcan,
and
a
new
Portuguese
language
center.
The
LAUSD
website
has
not
posted
updates
on
the
breach,
first
reported
over
Labor
Day
weekend
in
2022,
since

Sept.
30.

Subsequent
news
stories
refer
to
a
written
statement
from
IT
infrastructure
senior
administrator
Jack
Kelanic,
which
was
distributed
upon
individual
request
and
not
posted
to
the
district
site
or
Twitter.
About
Kelanic’s
statement,
the

Los
Angeles
Daily
Mail
wrote,
“The
500
psychological
evaluation
forms
analyzed
by
The
74
were
primarily
from
former
students
born
in
the
late
1980s
and
1990s.
Kelanic
also
said
that
60
of
the
leaked
student
assessments
were
those
of
current
students.”

When
a
hospital
system
lets
that
kind
of
information
go
public,
it
faces

fines
and
other
repercussions
under
HIPAA.
However,
when
a
school
leaks
it,
the
breach
is
covered
by
the
Family
Educational
Rights
and
Privacy
Act
(FERPA),
meaning
the
responsibility
to

file
complaints
lies
with
individual
parents.

Keep
up
with
the
latest
cybersecurity
threats,
newly-discovered
vulnerabilities,
data
breach
information,
and
emerging
trends.
Delivered
daily
or
weekly
right
to
your
email
inbox.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts