LIVERPOOL, N.Y. — Seven Liverpool High School students are facing charges and an employee was fired for sharing her login with a student whose classmates then used the credentials to access the district’s Student Information System (SIS).
Following a six-week investigation, the Onondaga County Sheriff says the employee shared the password with a student so they could use the building’s Wi-Fi network, WSYR reports. That student then reportedly shared the credentials with six other students who used it to access the SIS, which contains data such as grades, personal information, and disciplinary records.
RELATED ARTICLE: What is Quishing and How Can Schools Defend Against it?
Officials with the Liverpool Central School District sent out an alert last month informing them of the incident. Interim Superintendent Douglas Lawrence said there were more than seven instances of students accessing the portal but that they “used VPNs to mask their IP address.”
“While we have mandatory annual trainings focused on computer, internet, and data security for all staff, we still cannot stress enough how important it is to not share passwords or other information with others,” he said, noting all staff passwords have since been reset.
Students Suspended for Tampering with Discipline, Attendance Records
Lawrence said the students did not change any grades but did modify attendance and disciplinary records for themselves and others. Edin Semilovic, the father of one of the involved students, says his son has been suspended from school since November.
“He did make a mistake, we take responsibility for that mistake,” he said. “But the punishment that the school has given to these kids, it’s really in our opinion unnecessary to this point.”
RELATED ARTICLE: Behavioral Threat Assessments: Centralizing Student Data to Mitigate School Violence
Hisham Hamayel, the father of another involved student, told WSYR that his family appealed a full school-year suspension, getting it lessened to a multi-month suspension that ends in late January.
“Firstly, my son admitted to his actions on his own accord, demonstrating accountability and honesty. If the school’s system had been robust, the students would not have been able to exploit it,” he said. “The decision to press charges seems punitive and excessive, especially considering that the students have already faced substantial consequences for their actions.”
The five students accused of changing their own records have been charged with computer trespass and computer tampering, both felonies. Two others have been charged with unauthorized computer use, a misdemeanor.
