{"id":192784,"date":"2018-12-06T22:50:34","date_gmt":"2018-12-07T03:50:34","guid":{"rendered":"https:\/\/canadianinquirer.net\/v1\/?p=192784"},"modified":"2018-12-06T22:50:34","modified_gmt":"2018-12-07T03:50:34","slug":"father-says-teen-other-students-had-info-hacked-at-gta-school","status":"publish","type":"post","link":"https:\/\/canadianinquirer.net\/v1\/2018\/12\/06\/father-says-teen-other-students-had-info-hacked-at-gta-school\/","title":{"rendered":"Father says teen, other students had info hacked at GTA school"},"content":{"rendered":"
\"\"<\/a>
York regional police said they launched an investigation on Nov. 5 and found evidence of a database hack. (Pixabay Photo)<\/figcaption><\/figure>\n

When Kirk Tobias’ daughter logged onto her school’s student portal one morning last month, she was greeted by an ominous note.<\/p>\n

Under the image of a leering face was a list containing her address, telephone numbers and school-related log-in details, accompanied by a threat of further contact from what appeared to be an anonymous hacker, the father of the 16-year-old said.<\/p>\n

The frightened teen informed her parents, who said they promptly reported the matter to her high school in Markham, Ont. The institution called police \u2014 who confirmed a database hack \u2014 but Tobias said he believes the school’s board only learned of the incident when he called its privacy officer.<\/p>\n

\u201cThey’re not doing what they need to do to protect the data of the students,\u201d Tobias said of the school and the board. \u201cIf they had a system in place from the beginning that had proper protocols to protect the data, none of this ever could have happened.\u201d<\/p>\n

The episode illustrates an issue raised in this week’s report from Ontario’s auditor general, who flagged widespread concerns about student data security at the province’s 72 public school boards.<\/p>\n

Tobias said the drama with his daughter began unfolding unbeknownst to him and his wife when his teen received a phone call on Nov. 3 from a student with whom she shared a class at Markham District High School but had no prior social interaction.<\/p>\n

The digital note on her computer appeared the next morning when she logged into the Google Applications account set up by the board to handle many school communications, Tobias said.<\/p>\n

\u201cTo say that she was completely freaked out was a gross understatement,\u201d he said.<\/p>\n

Tobias said he went directly to the school the following day and the institution notified police.<\/p>\n

York regional police said they launched an investigation on Nov. 5 and found evidence of a database hack.<\/p>\n

\u201cIt appears that the suspect had accessed a file that contained the login information and passwords for all of the students at the school that give them access to their student account file,\u201d said Const. Andy Pattenden.<\/p>\n

He said police opted not to lay charges against a teen believed to responsible but instead issued a verbal caution under the Youth Criminal Justice Act.<\/p>\n

Tobias said he remained in contact with the school throughout the week the hack was discovered in a bid to address both the data breach and what he felt was a threat to his daughter’s safety. Dissatisfied with the response he was getting, he said he took matters to the privacy officer at the York Region District School Board.<\/p>\n

Tobias said the officer told him the school had not informed her of the data breach.<\/p>\n

The school contended otherwise in a note to parents on Nov. 13 that outlined the information that had been accessed. The principal stated in the letter that she had notified the board’s privacy office. That was repeated in a followup notice Nov. 28, in which the principal said student passwords were changed in response to the breach.<\/p>\n

Markham District High School’s staff declined to comment on the situation, referring inquiries to the board.<\/p>\n

Board Associate Director Karen Friedman issued a statement confirming that a breach of student information had taken place in early November, that student passwords had been changed in response, and that the board had co-operated with the police investigation.<\/p>\n

She did not immediately respond to questions as to how the board learned of the breach in the first place, but said extra security measures were being put in place.<\/p>\n

\u201cYork Region District School Board takes the security of student personal information very seriously,\u201d she said. \u201c… We are very sorry for any issues this has caused.\u201d<\/p>\n

On Wednesday, Ontario’s auditor general warned of such situations in her annual report, saying public school boards were not taking \u201call reasonable steps\u201d to secure student information.<\/p>\n

Bonnie Lysyk said the use of outdated technology that’s vulnerable to hacking or the failure to close security loopholes was concerning.<\/p>\n

\u201cAccounts of inactive users of the ministry’s IT system are not always being cancelled after they leave their positions at the boards,\u201d the report reads. \u201cThese accounts are accessible on the internet, which means that there is a risk that confidential student information may be exposed to the public.\u201d<\/p>\n

\u2014 with files from Liam Casey.<\/p>\n","protected":false},"excerpt":{"rendered":"

When Kirk Tobias’ daughter logged onto her school’s student portal one morning last month, she was greeted by an ominous …<\/p>\n","protected":false},"author":44,"featured_media":192804,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18,16],"tags":[],"class_list":["post-192784","post","type-post","status-publish","format-standard","has-post-thumbnail","category-news-ca","category-news","mauthors-michelle-mcquigge","mauthors-the-canadian-press"],"_links":{"self":[{"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/posts\/192784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/comments?post=192784"}],"version-history":[{"count":0,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/posts\/192784\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/media\/192804"}],"wp:attachment":[{"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/media?parent=192784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/categories?post=192784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/canadianinquirer.net\/v1\/wp-json\/wp\/v2\/tags?post=192784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}