Security Breach FAQ's
Published July 17, 2008
Questions About The Breach
Q: What happened?
A: In August of 2007, an employee of Williamson County Schools uploaded a file containing student data to a website he created, www.tnweb.org. This website was unrelated to Williamson County Schools, and the information was not labeled as student data nor was it accessible from the menu of the website. Within 30 days the mistake was discovered by a non-profit consumer group called the Liberty Coalition that notified the employee of the exposure of the information. The employee and the Liberty Coalition immediately took steps to remove the website and the data from the internet. The employee did NOT notify Williamson County Schools. Since there was no reference to Williamson County Schools in any of the information, the Liberty Coalition did not know to notify us. On June 26, 2008, we discovered the possibility of this breach and began our investigation.
Q: What information was exposed on the internet?
A: The student information consisted of names, dates of birth, test data and social security numbers of students who took the second grade TCAP achievement test and students who took the ACT test during the 2006-2007 school year, which is typically juniors and some seniors in high school. The number of students in this group is approximately 5,300 (Group 1). While there was name, date of birth and test data posted regarding other students, no other students had social security information posted. This second group consists of approximately 11,000 students (Group 2).
Q: Who accessed this data? Is there any evidence of foul play?
A: At this time there is no evidence to suggest that the information was accessed by any group other than the non-profit consumer group that helped to bring the situation to light; however, that possibility can not be ruled out. We believe that this incident occurred due to an unfortunate error in judgment on the part of the district’s employee, and there was no intent to disclose or to harm any children.
Q: How long was the information on the internet?
A: To the best of our knowledge the file was on the website for less than 30 days. The website was taken down within hours after notification of the exposure. Search engines were contacted to clear their cached (stored) pages that might reflect the information. This was concluded in early October, 2007.
Q: Is the employee referenced, Chris Nugent, still employed at the school district?
A: No. Mr. Nugent is no longer employed by the district.
Q: The notice letter says that Williamson County Schools learned of the theft on June 26, 2008. Why did they wait until now to notify me?
A: We have worked since June 26, 2008, to identify the list of students in Group 1 and to provide parents with services that will help to identify and address any potential misuse of student information. To do that, we first needed to interview the employee who posted the website and the non-profit company that first discovered the information on the internet to get a complete understanding of what happened and to make sure that all exposure had been addressed. In doing so, we also had to notify all of the proper authorities. We then worked to identify reliable providers of identity monitoring and fraud resolution services. After selecting National ID Recovery (NIDR) for those services, we promptly negotiated agreements and put the desired services in place. Once the contracts were executed, we still needed to finalize the notice. Also, we had to obtain and match addresses with the student names since this was not part of the data attached to the student file. The letters are scheduled to be mailed during the week of July 14, 2008, to the parents of students whose social security numbers were exposed.
Q: I have not received a notification about the privacy incident. Does that mean that my student is not affected?
A: Williamson County Schools is sending notice letters to all parents of students in Group 1 whose social security numbers were exposed. If your child was in this group, you should receive a notice by July 23, 2008. There may be some students who have moved out of the district and/or graduated and may not have been contacted. If you did not receive a letter and remain concerned that your child may have been in this group, you may request information by emailing Lydia Glynn at lydiag@wcs.edu.
Q: Will someone contact me to ask for my child’s personal information in order to activate services?
A: No! For those parents whose child’s social security number was exposed (Group 1), we have established a special toll-free number directly to National ID Recovery. The phone number is included in the parent letter. The parent must place the call. This is for your child’s protection. It is a tactic of identity thieves to take advantage of a well-publicized breach situation and randomly contact persons hoping to find someone who is in the affected group, and then ask for personal information. We recommend that you do not release personal information in response to any contact of this nature that you did not initiate yourself.
Q: Can I go to www.ssnbreach.org to find out what information was published regarding my child?
A: The website www.ssnbreach.org is sponsored by a non-profit organization called the Liberty Coalition, which is not affiliated with Williamson County Schools. If you go to this website, be aware that this organization, although non-profit in structure, displays links to various identity theft companies that charge fees for their services and which may not be appropriate for children. Also, if you see a notation of “SS” on the list that is returned in your search, (for example, “Math SS, Soc St SS”) it means scale score, not social security. This is the case for most students who took the third through eighth grade TCAP. If your child’s social security number was exposed, it should specifically state “social security number” on the list.
Q: What is Williamson County Schools doing to prevent this from happening again?
A: Williamson County Schools is no longer requiring social security numbers as part of the registration process, effective immediately. All new students will be issued a Personal Identification Number (PIN). In addition, we are working with the Tennessee Department of Education on efforts to remove all existing social security numbers from the Williamson County student information system by replacing social security numbers with a student PIN.
Questions About Identity Theft
Q: How much risk does this incident pose to my child’s identity?
A: Experts in dealing with identity theft have told us that accidental breach events, such as this one, do not typically have a high risk of identity theft. However, this is no guarantee. That is why Williamson County Schools is providing proactive identity monitoring and professional recovery services if identity theft should occur for any reason.
Q: Has anyone been victimized by ID theft because of this incident?
A: To date, we are not aware of any student who has been victimized by ID theft because of this incident.
Q: What do I do if I learn that my child’s identity has been misused?
A: Contact National ID Recovery to explain the situation. Use the special toll free
number or identify yourself as a parent of a Williamson County child. The
advocate will guide you through the proper course of action.
Questions About Services That Are Being Provided
Q: What services are being provided for students in Group 1 whose social security numbers were exposed?
A: Williamson County Schools is providing one year of identity monitoring services designed to detect misuse of a student’s personal information and professional identity recovery services if any fraud is found. A special toll-free number direct to National ID Recovery has been established. During the initial phone call, National ID Recovery will determine if a credit file exists for your student, and if so will immediately place fraud alerts, obtain copies of credit reports and begin an investigation to identify and address any evidence of fraud.
Q: What services are being provided for students in Group 2 whose social security number was NOT exposed?
A: If a parent of a child in Group 2, whose name, date of birth, and test scores were exposed, believes that their child has been compromised by fraud for any reason National ID Recovery will provide an advocate to address the issue until it is resolved. Once a case is opened, it will continue until all issues are resolved, even if the timeline goes beyond the expiration of the one year benefit.
Q: Is there a deadline to enroll in the identity monitoring service?
A: No, but we encourage all parents in the affected group to promptly contact National ID Recovery to activate the monitoring services. The monitoring services will be provided through July 23, 2009.
Q: What does identity monitoring do?
A: Identity monitoring uses a sophisticated software system that looks for anomalies, or “red flags,” in the use of personal information. For instance, in the case of a minor, it checks the credit bureaus for the existence of a credit file. It also looks at companies that collect large amounts of data, like Lexis Nexis, to see if the personal information of the person is being used for true name or other forms of identity theft. If something unusual is found, an alert is issued. An advocate will get in contact with you to discuss whether the alert is evidence of a problem or not. If it is a problem, the advocate will open a case and begin the process of recovery for you. So, in other words, it is an early warning system.
Q: Is this just like credit monitoring?
A: No. While credit monitoring is limited to credit, identity monitoring looks for many types of identity theft. Also, credit monitoring depends on the fact that a credit file exists. Then on an ongoing basis it alerts you if something new is added to that credit file. You must determine whether the new activity is legitimate or fraudulent. Since a child should not have a credit file, credit monitoring is ineffective.
Q: How did you select National ID Recovery?
A: We looked at eight different companies to determine the best fit for our situation. We felt that National ID Recovery had the best approach, was the most hands-on to help make it easy for parents, had the most comprehensive services, and had more experience working with children’s identities than the other companies.
Q: What will National ID Recovery do for me and my child if identity theft does occur?
A: A professional identity theft advocate will be assigned to manage your case. This person is a trained paralegal professional who will perform an analysis of the case, document all incidents of fraud, and provide all of the paperwork, phone calls, and follow-up to make sure that each incident of fraud is addressed and expunged. The advocate will also work with law enforcement, to the extent possible, to help to identify and apprehend the criminal.
Q: Is National ID Recovery staffed to handle calls from 5,000 parents?
A: Yes. They have handled cases involving hundreds of thousands of individuals such as this. However, please be patient if for some reason you do not get through on the first call, just wait a few minutes and call again. Occasionally there will be an influx of calls that will require you to wait.
Q: What if there is identity theft in my child’s name but we can’t prove that it is connected to this incident?
A: You do not have to show a connection to this event. The services that are being offered through National ID Recovery are available for any identity theft situation, no matter how it occurs, even if you know that it is NOT connected to this incident.
Q: What kind of information has been given to National ID Recovery?
A: National ID Recovery has been provided with a list of student names and addresses in order to complete the notification process. In order to begin the identity monitoring process, a parent will need to call the toll free number and provide the student’s social security number, your phone number and email address, if you have one.
Questions About Fraud Alerts and Credit Reports
Q: What is a fraud alert?
A: Generically speaking, a fraud alert tells creditors to contact you before opening any new accounts or changing your existing accounts. Once you notify one of the three national credit bureaus of your fraud alert, the others will be notified to place a fraud alert as well. All three credit bureaus also will send you one credit report, free of charge. Since your child shouldn’t have a credit report, with the possible exception of some older teens, a fraud alert can not be placed.
Q: What is the best way to find out if my child has a credit report?
A: The best way to find out if your child has a credit report is to call in or attempt to place a fraud alert online. If your child has no credit report, the attempt will fail. This is the desired result! You can either call one of the credit bureaus listed below or, if you are in the affected group, you can call the number for National ID Recovery on the notice letter and a representative will help you complete this test. If you are able to place a fraud alert, we suggest you follow through to obtain the credit report and review what is contained on the report. If you are working with an advocate at National ID Recovery, they will do this for you.
Call any ONE of the credit reporting agencies below if you want to place a fraud alert or learn if your child has a credit report.
Equifax: 1-800-525-6285; www.equifax.com
Experian: 1-888-397-3742; www.experian.com
TransUnion: 1-800-680-7289; www.transunion.com
Q: I have been told that I can request a copy of my child’s credit file, and even if one doesn’t exist, a file will be created by my inquiry. Then I can place a fraud alert on the file. Should I do this?
A: This may not be a good idea. It will make it harder to detect potential problems going forward, since an empty file will exist. It is easier to monitor a minor’s status when there is no file. It can also make it difficult for your child to obtain credit, once they get ready to do so. Also, you need to consider that a fraud alert will not guarantee that your child’s personal information will not be used for credit and other forms of identity theft. You should learn about the pro’s and con’s before taking any action on your own. If after considering all of your options, you still have concerns about your child’s identity being exposed, contact National ID Recovery prior to placing a fraud alert.