7 Liverpool high school students gained unauthorized access to the student information system

LIVERPOOL, NEW YORK — Seven students at a Liverpool high school have been charged and a staff member fired for providing her login to a student whose classmates then used the credentials to access the District Student Information System (SIS).

After a six-week investigation, the Onondaga County Sheriff’s Office says an employee shared a password with a student so they could use the building’s Wi-Fi network, WSYR reports That student then reportedly shared the credentials with six other students who used them to access the SIS, which contains data for example, grades, personal information, and disciplinary records.

RELATED ARTICLE: What is quishing and how can schools protect themselves against it?

Liverpool Central School District officials sent notification last month informing them of the incident. Interim Superintendent Douglas Lawrence said there were more than seven instances of students accessing the portal but “using a VPN to mask their IP address.”

“While we have mandatory annual computer, internet and data security training for all employees, we still cannot stress how important it is not to share passwords or other information with others,” he said, noting that all employee passwords have since been reworked. cast.

——Article continues below——

Students were suspended for violating discipline and attendance records

Lawrence said the students did not change any grades, but did change attendance and disciplinary records for themselves and others. Edin Semilovych, the father of one of the involved students, says that his son was suspended from school since November.

“He made a mistake, we are responsible for that mistake,” he said. “But the punishment that the school applied to these children is, in our opinion, unnecessary at this time.”

RELATED ARTICLE: Behavioral Threat Assessment: Centralizing Student Data to Mitigate School Violence

Hisham Hamayel, the father of another student involved, told WSYR that his family appealed the full suspension for the school year, reducing it to a multi-month suspension that ends at the end of January.

“Firstly, my son admitted his actions of his own free will, demonstrating responsibility and honesty. If the school system was secure, students would not be able to use it,” he said. “The decision to press charges seems punitive and excessive, especially given that the students have already suffered significant consequences for their actions.”

The five students accused of altering their own records were charged with computer intrusion and computer tampering, both felonies. The other two are charged with unauthorized use of a computer, a misdemeanor.