Dad says teen daughter and others were hacked at Markham high school
Students 'freaked out' after anonymous hacker accesses addresses, telephone numbers
When Kirk Tobias's daughter logged onto her school's student portal one morning last month, she was greeted by an ominous note.
Under the image of a leering face was a list containing her address, telephone numbers and school-related log-in details, accompanied by a threat of further contact from what appeared to be an anonymous hacker, the father of the 16-year-old said.
The frightened teen informed her parents, who promptly reported the matter to her high school in Markham, Ont. The institution called police — who confirmed a database hack — but Tobias said the school's board only learned of the incident when he called its privacy officer.
Tobias said the episode had left his family shaken.
"To say that she was completely freaked out was a gross understatement," Tobias said of his daughter, adding he and his wife were equally unnerved by the widespread breach.
Police said they determined that one of the teen's classmates had hacked into the school's database and retrieved personal details for the entire student body of about 1,500 people.
17-year-old cautioned by police
Markham District High School's staff declined to comment on the situation, referring inquiries to the board.
Board Associate Director Karen Friedman issued a statement confirming that a breach of student information had taken place in early November, that student passwords had been changed in response to the incident, and that the board had co-operated with the police investigation into the matter.
She did not immediately respond to questions as to how the board learned of the breach in the first place.
York Regional Police, for its part, said a 17-year-old boy had been issued a verbal caution in connection with the hack.
The incident illustrates concerns raised in Wednesday's annual report from Ontario's Auditor General, who flagged a series of issues related to information technology at the province's 72 public school boards.
Bonnie Lysyk said school boards are not taking "all reasonable steps" to secure student information, either through using outdated technology that's vulnerable to hacking or through failing to close security loopholes.
"Accounts of inactive users of the ministry's IT system are not always being cancelled after they leave their positions at the boards," the report reads. "These accounts are accessible on the internet, which means that there is a risk that confidential student information may be exposed to the public."