Investigation finds no evidence of data removal, My Future Hawai‘i turned off

From UH News, Sep 6, 2019

An investigation into a recent data exposure of a vendor contracted by Hawaiʻi P-20, Graduation Alliance, reported that data used for college and career planning resources on the My Future Hawai‘i website did not reveal evidence that any data was stolen. 

Graduation Alliance informed Hawaii P-20, an organization of the University of Hawaiʻi, and the Hawaii State Department of Education (HIDOE) about the potential data exposure in July 2019. UH and HIDOE informed the public and parents/guardians of students in participating middle and high schools regarding the situation. After the reported activity, Graduation Alliance hired a data forensics company to investigate the incident.

UH has since notified Graduation Alliance that the contract will be terminated, indicating that Graduation Alliance failed to implement certain requirements of the agreement intended to protect the data.  

Hawai‘i P-20 worked with Graduation Alliance to create the website to provide middle and high school students and families with college and career planning resources, financial aid guidance and an expedited application process for the university. 

While the forensics data report found that there was no evidence that student data was removed, UH officials want to remind families that cyber security best practices recommend that everyone should always monitor their accounts for unusual activities by:

• monitoring all personal accounts for unauthorized activities (these include email accounts, social media accounts, financial accounts, etc.)
• following the Federal Trade Commission’s recommendation on “Protecting Your Identity”.

UH continues to remain committed to protecting the privacy and security of data, and is taking necessary measures to confirm the forensic report’s findings and to prevent future incidents. Although the My Future Hawai‘i website is shut down, Hawaiʻi P-20 is working with HIDOE and UH to find other options to provide schools, students and their families with the tools and resources to continue supporting college and career planning guidance.

  *   *   *   *   *

Statement from Graduation Alliance Sept 9, 2019

“Graduation Alliance (GA), an accredited education services provider, successfully completed an investigation finding no evidence that any student data was accessed, stolen or viewed by any unauthorized persons during a recent attack on a testing environment for a college and career exploration and planning platform for two customers. GA was assisted in its investigation by an independent forensic firm. No public-facing websites or systems were affected in this incident.

We are grateful for the diligent and swift actions that our team took to intercept this attack. Protecting the privacy and security of our students and customers' information is a top priority. As we move forward, we will continue to look for opportunities to enhance our cybersecurity and data protection strategy.” 

 -Graduation Alliance

  *   *   *   *   *

SA: Probe finds no unauthorized access to Hawaii public school student data

July 22, 2019: Personal information for 70,000 Hawaii students potentially compromised

Sept 6, 2019: Statement from P-20