Security researcher finds sensitive documents from Chicago area school districts exposed online
CHICAGO (CBS) -- It's something you would never want exposed on the internet – the lockdown locations, active shooter protocols, and medical data from your child's school.
But a software company dedicated to making schools safer just left their cybersecurity doors wide open in a data breach. Some of the extremely sensitive documents exposed in the massive data leak are from schools right in the Chicago suburbs.
Fortunately, the more than 4 million documents were found by an ethical cybersecurity researcher, Jeremiah Fowler, who said this should all serve as a warning.
Active shooter lockdown drills, student and campus threat assessments, and court records detailing restraining orders and parental abuse were just some of the sensitive documents Fowler uncovered.
"I reviewed a few documents, and immediately knew that it was bad - and it shouldn't be exposed," Fowler said.
Fowler said the records were in a non-password-protected database, and were linked to Raptor Technologies – a company that claims to provide more than 5,300 U.S. school districts with technology to track everything from attendance to preparing for a school shooting.
"In Raptor's case, it's a wake-up call. Hopefully, this data doesn't fall in the wrong hands," Fowler said. "I haven't seen a range or span of documents like that, I don't think, ever."
Raptor Technologies sent Taft District 90 in Lockport and West Aurora School District 129 a letter notifying them that they could be part of the data leak.
District 95 in Lake Zurich said at least two documents from their schools were also uncovered by Fowler. The district said it does not know the content of the documents and has asked for more information.
"We don't want school leaders to unintentionally turn over their entire plans to those with nefarious intentions," said Dr. Kenneth Trump, president of National School Safety and Security Services.
Dr. Trump is a school security and safety expert – consulting with schools all over the country, including the Chicago suburbs.
"Far too often, school administrators are in awe over the new bells and whistles. They're under pressure to beef up security," said Dr. Trump, "and they are making some quick judgements without critical thinking; without considering unintended consequences."
Fowler, the cybersecurity researcher who uncovered all the documents, said it was pretty simple to find all the information. He brought it to the attention of Raptor Technologies, and he said the company secured the data immediately.
West Aurora School District 129 released the following statement:
"We were recently made aware of Raptor's data leak, and as a customer of theirs, we anticipate that some of our data was accessed by a single cybersecurity researcher.
"Raptor has informed us that they believe that the data and documents have not been accessed by any third parties beyond the single cybersecurity researcher and Raptor personnel.
"We are fortunate to have a staff member who sits on Raptor's customer advisory board. She is in the process of working with Raptor to uncover the specific information that was accessed so we can respond appropriately."
Raptor Technologies chief marketing officer David Rodgers also released a statement:
"We care deeply about the safety and wellbeing of children and all those community members our customers serve, which is exactly why we took prompt action when made aware by a cybersecurity researcher of an issue involving certain cloud-hosted data repositories. We secured the data repositories in question and communicated with our customers.
"Importantly, we have no evidence that there has been any misuse of the information stored in these data repositories. We are committed to safeguarding our customers' information and their trust in line with our mission to protect every child, every school, every day."