Updated: Sachem Responds To Student Data Leak Questions

Answers to questions Sachem Central School District has been receiving from the community regarding the leak of student information has been posted to the district's website Tuesday afternoon.

The district discusses investigations they have been pursuing since late July 2013 from leaks they were informed of that summer, how the district was informed of the current breach, what information they are able to discuss among others.

According to the statement, the district was first made aware of a small number of documents relating to certain students on an internet forum in late July 2013. The post claimed Sachem's database was "hacked," but the district says their data systems have not been breached from the outside after taking an audit of their firewalls and intrusion detection systems.

The district says they became aware of additional student information postings in August, and had filed a police complaint with Suffolk County Police Department. At that time, information posted was determined by police to have been directory information. This consists of staff names, email addresses and other addresses, and not social security numbers, credit card or driver's license information, the district said. Another audit of the systems took place, and the district found no breach.

The district also contacted the host site to demand that any post with student information be deleted as quickly as possible, and the district says in every instance the host site has been “extremely cooperative.” While this statement does not specify this, Fred Gorman who manages the Sachem Unspun website told Patch earlier this month that over the past few months there have been accounts posting district information to his site’s forums. Gorman said he has been removing the district information while keeping up comments discussing it.

The November breach, which is the first one the school district has alerted the community about on its website, was discovered by the district when the Superintendent James Nolan was informed of student information being posted on a webpage linked through a local online forum on Nov. 8. This matter has been brought to both Suffolk County Police Department and the Federal Bureau of Investigation, which the district is in contact with. However the district is not discussing specific details of the investigation of the November breach, as they say it could complicate the investigation.

“We are doing our best to keep the public reasonably informed without creating the potential for misinformation, or discussing matters that could compromise the investigation into this matter,” the statement said.

What they did announce is that what was posted in November includes a list of 15,000 names with student ID numbers and school lunch designation (with no other information attached appearing to be a list from the early 2000s), a list of 12,000 names with student ID numbers with no other information (of which all but 900 were included in the first list), student records relating to approximately 360 students who graduated from Sachem High School East in 2008 and a report relating to approximately 130 students who attended Sachem High School North receiving instructional services in an alternative setting in the 2010-2011 school year

The district also said in the statement that they are not required by law to offer credit or identity theft protection, but are required to notify individuals the district reasonably believes have been affected. These notifications started last week.

The district said all of the listed people have or are receiving notifications, and an additional group of 360 individuals whose records were in the same folder of records the district believes have been compromised in some way.

The district also believes that anyone who has downloaded the information made available , if it does not pertain to themselves or their child, could possibly be in some degree of legal trouble.

Click here to read the full Q&A.

What are your thoughts on this investigation? Talk about it in the comments below this post.

This is a breaking news post. The breaking news alert email erroneously says Wednesday afternoon, this has been corrected to Tuesday afternoon in the story. Story additionally updated at 4:52 p.m. with additional information. Updated again at 7:16 p.m. to fix typos.