State Education Superintendent Eric Mackey informed the public on Wednesday that the Alabama State Department of Education (ALSDE) website was hacked, possibly exposing the personal information of education employees across the state.
ALSDE information system staff reportedly detected and stopped the cyberattack on June 17, but not before some data was breached.
Mackey said the attorney general's office, state and federal law enforcement and an independent contractor were investigating the breach but would not elaborate on what data had been compromised.
"The hackers were not able to fully access our system or to lock us out of our system," Mackey said. "However, before our information services professionals were able to interrupt and stop the hack, some data were breached, we believe."
He continued, "We began immediately to mitigate the circumstances. This is an ongoing criminal investigation and, therefore, there's limited things that we can say and limited information that we can give out at this time."
Mackey repeatedly stated that a "criminal syndicate" was behind the attack, suggesting that the source of the attack was "foreign." Mackey would not state if those behind the attack had contacted the ALSDE with a list of demands. However, he emphatically stated that the state was not going to "negotiate with foreign actors or extortionists."
"We can't give specific information, but on our servers, we do keep backup student data and employee data, and those are state department employees and local education employees," Mackey said. So, there is a possibility, and again, I can't say specifically, and I know that people are going to want to know, 'Do you know if my data are involved?' I don't even know if my personal data are involved. Obviously, I have data stored on the site. I have three sons who went through Alabama Public Schools, so I don't know if their personal data is involved."
"But what I would say is that, to all parents and all local and state education employees out there; they should monitor their credit. They should assume that there's a possibility that some of their data were compromised."
Mackey clarified that the state servers did not keep or collect direct deposit information, such as bank account or routing numbers, only personally identifiable information.
The ALSDE launched a website with information on the hack, including information for best practices for those who believe they may have been affected by the breach.
"The Federal Trade Commission (FTC) recommends that you place a free fraud alert on your credit file," the site reads. "A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts. Contact any one of the three major credit bureaus. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts. The initial fraud alert stays on your credit report for one year. You can renew it after one year.
"Ask each credit bureau to send you a free credit report after it places a fraud alert on your file. Review your credit reports for accounts and inquiries you don't recognize. These can be signs of identity theft. If your personal information has been misused, visit the FTC's sit at identitytheft.gov to report the identity theft and get recovery steps. Even if you do not find any suspicious activity on your initial credit reports, the FTC recommends that you check your credit reports periodically so you can spot problems and address them quickly."
It continued, "You may also want to consider placing a free credit freeze. A credit freeze means potential creditors cannot get your credit report. That makes it less likely that an identity thief can open new accounts in your name. To place a freeze, contact each of the major credit bureaus at the links or phone numbers above. A freeze remains in place until you ask the credit bureau to temporarily lift it or remove it."
To connect with the author of this story or to comment, email craig.monger@1819news.com.
Don't miss out! Subscribe to our newsletter and get our top stories every weekday morning.
