South Washington County Schools mistakenly emails data on thousands of students
South Washington County Schools apologized and launched an investigation last week after personal data on most of the district’s 18,000-plus students was mistakenly emailed to parents.
District administrators first scrambled to try to limit public access to the data after it was sent Wednesday, Aug. 16, and started investigating the cause of the release and how to rectify the situation as the new school year approaches.
The private data was contained in emails outlining student busing plans for the upcoming school year. Parents received an email that either contained data on 9,000 families or another file on over 9,600 other families. Some parents with multiple students in the district received both data files in separate emails.
“On behalf of the district, I apologize for this error,” Superintendent Keith Jacobus said.
The files contain student names and identification numbers, home addresses and schools; parent names, phone numbers and email addresses; and student busing information, including pick-up and drop-off time and location and the bus name.
The district already said it is renaming the buses and is exploring changing the routes. It also is exploring whether to change student identification numbers. Student safety is the No. 1 priority, Jacobus said.
The emails were from the Transportation Department, but the district uses a mass notification service called Blackboard Connect to communicate with parents. Jacobus said the investigation will look at how the files were attached to the emails
“We know it was not done intentionally or maliciously, and that it was a mistake or employee error,” he said in an interview.
Jacobus said the investigation also will look at why access to the files was not disabled earlier. The district could not disable the files Wednesday night because the emails were sent through the Blackboard Connect service, according to administrators. The files could be viewed Thursday morning without any special access, some 12 hours after they were sent. Eventually both were deactivated.
“I’m not sure why that took so long,” Jacobus said.
Communications Director Barb Brown said administrators learned of the release within about 15 minutes of the emails being sent, but it took time before the district made its first statement about three hours later.
“There’s just a lot of things that you need to consider, and we don’t want to make another misstep” by releasing inaccurate information to the public, she said.
Legal implications added to the district’s desire for caution, Brown added.Parents upset
The mistake angered parents, who took to Facebook to vent about security concerns, such as the safety of children in protective custody and others whose busing information had fallen into the public domain with no chance of being recalled. A few parents spoke up at the District 833 School Board meeting Thursday.
Landon Omtvedt said he heard nothing from the district about the students as young as kindergarten who were on the list but walk to school.
“Now everybody who got this email knows where they live, knows where they’re walking, knows what school they go to — even knows their name,” he said. “This is a huge issue. It’s a grave injustice to us taxpayers. It’s a huge problem for accountability.”
Others urged parents to file complaints with the Minnesota Department of Education, and to demand that Jacobus own the responsibility, saying it was a systemic problem rather than the fault of just one employee.
Joseph Hernandez of Woodbury has three kids in the district — two at Red Rock Elementary, one at Lake Middle School — and he received an attachment in each student’s transportation information email.
“The concern is that it’s almost like a perfect list of every student if you’re looking for them, with all their contact information,” Hernandez said in an interview. “I guess they assume everyone in the district is a nice person, and that can’t be true.”
Hernandez said there also are identity theft concerns. He said this also raises questions about the district's data policy.
“It shows just a lack of maybe knowledge or care about data,” he said.
Jacobus said the district has been in consultation with its attorney. He also asked that parents delete the attachment and not forward it to others.
The district will prepare a report when its investigation is complete, and parents will be able to request a copy of the report.
Jacobus said the district acknowledges the error and will work to address parent concerns. He said this was not how the district wanted to begin the school year.
“We are all saddened by the need to focus our attention and concerns on the disclosure of this educational data, rather than the excitement of what a new year brings to students and to staff,” Jacobus said.