TAMPA, Fla. — Hillsborough County Public Schools sent out notifications to 254 families on Friday that someone may have accessed the personal data of some of its students in a data breach.
An e-mail from the schools' chief of communications said the data may have included a student's name, date of birth, student ID and state ID number, which could correspond to the student's social security number. The data may also have included information about visits to the school nurse's office during the 2021-2022 school year.
HCPS is currently reviewing the files that were potentially accessed in the breach and its officials are cooperating with the Florida Department of Law Enforcement, the FBI and the Cybersecurity and Infrastructure Security Agency. They say they will offer free identity protection services for any student, as long as their parents enroll them into the services by Jan. 21, 2024.
In a written statement, HCPS says its monitoring systems picked up unusual activity in some of its network systems, which prompted it to take a number of systems offline as a precaution. Officials then conducted an investigation with the help of a team of cybersecurity experts and reported the breach to state and federal authorities.
The letter sent out to parents reads as follows:
Dear Parent or Guardian of _____.
I am writing to provide you with an important update about a data security incident that may have affected your child’s personally identifiable information. At Hillsborough County Public Schools (HCPS), we take the privacy and security of student information very seriously. This is why we are informing you of the incident, providing you with steps you can take to protect your child’s personal information, and offering you complimentary identity protection services for one year.
What Happened. HCPS recently identified unusual activity involving some of our network systems. The district’s monitoring systems effectively prevented widespread disruption. Additionally, we took offline a number of our network connected systems as a preventative measure. We engaged a team of cybersecurity experts to assist in our response and conducted an investigation. The investigation determined that certain administrative files from the 2021-2022 school year were accessed without authorization. HCPS launched a comprehensive review of the potentially affected files. While this review is ongoing, a preliminary review identified one file containing personally identifiable information for your child.
What Information Was Involved. The information may have included your child’s name, date of birth, district student ID, and State ID number, which may correspond to your child’s Social Security Number, and information about a visit to the school nurse’s office during the 2021-2022 school year.
What We Are Doing. As soon as HCPS discovered the incident, we took the steps described above and implemented measures to enhance network security and minimize the risk of a similar incident occurring in the future. We also reported the incident to the Florida Department of Law Enforcement, the Federal Bureau of Investigation, and the Cybersecurity and Infrastructure Security Agency, and we will provide whatever cooperation may be necessary.
In addition, we are offering you complimentary identity protection services for your child through IDX, a ZeroFox Company. The IDX services include 12 months of CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery services. The deadline to enroll your child in the IDX services is January 21, 2024.
What You Can Do. We encourage you to activate your child’s complimentary IDX services using the enrollment information provided above. You can also follow the recommendations on the following page to help protect your child’s personally identifiable information.
For More Information. If you have questions about this incident, we have established a special hotline for affected families.
We take your trust in us and this matter very seriously. Please accept our sincere apologies for any worry or inconvenience this may cause you.
Hillsborough County Public Schools