Breach, Threat Management, Data Security

Data breach more than 4X worse than first thought for Montgomery County schools


What at first looked like a single data breach affecting Montgomery County Public Schools (MCPS) in Maryland turned out to be a series of breaches that impacted thousands of more students than was originally reported.

On Oct. 4, 2019, MCPS disclosed that a district student had one day earlier allegedly executed a brute-force credentials-stealing attack against Wheaton High School's Naviance platform and downloaded demographics data from 1,343 accounts registered to students. Naviance is an online college and career readiness program.

But in an updated online disclosure published late last month, MCPS announced that a forensic investigation conducted by the Montgomery County Police Department revealed additional intrusions that took place between Sept. 12 and 14. The district has now revised the total number of compromised accounts to 5,962 across six schools.

In addition to Wheaton, Montgomery Blair High School, Julius West Middle School, Argyle Middle School, Parkland Middle School and A. Mario Loiederman Middle School were also hit by the breach.

Exposed data included names, birth dates, home addresses, email addresses and phone numbers, as well as academic information such as student ID number, weighted GPA, highest SAT score and more.

"At this time, MCPD does not believe that the student shared any accessed information with others," the district's updated notification states. "The student currently faces additional disciplinary action based on the expanded scope of the brute-force attacks as well as possible criminal charges."

Following the original discovery of the breach, MCPS forced a district-wide password reset for all Naviance student accounts to prevent any additional unauthorized access.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.