A Montgomery County, Md., high school student earlier this month hacked into the Naviance college prep system and downloaded and shared the PII from about 1,400 fellow students.
The initial investigation using information provided by Naviance led the school district to initially suspect two students. On October 7 the Montgomery County Police Department was brought in and the student behind the attack was identified. The as-yet-unnamed student faces disciplinary action from the school and possible criminal charges.
Montgomery County Public Schools officials said the incident took place on October 3 and affected 1,344 Wheaton High School students. The hacker used a brute force attack to discover the usernames and passwords needed to access the Naviance accounts. The attack started at 8:10 pm and ended 10:14 pm when Naviance discovered the suspicious activity and blocked the attacker’s IP address.
Naviance
notified the district on October 4 and then reset all the affected user’s login
credentials.
“The unauthorized user then
downloaded demographic information from the accessed accounts. The information
accessed did not include social security numbers, banking information, or
credit card information,” school officials said.
The information illegally
collected included name, ethnicity, gender, GPA, date of birth, grade level,
student ID number, highest ACT, SAT, PSAT and IB score, home and email address,
home and mobile phone number and even the student’s nickname.
The student allegedly behind
the hack said the downloaded information had been shared with other students.
