NASHVILLE, Tenn. — Update 9/4/19:
Graduation Alliance said Wednesday that the investigation is complete and no student data was accessed, stolen or viewed by any unauthorized persons.
The vendor issued the following statement to 10News on Wednesday:
“Graduation Alliance (GA), an accredited education services provider, successfully completed an investigation finding no evidence that any student data was accessed, stolen or viewed by any unauthorized persons during a recent attack on a testing environment for a college and career exploration and planning platform for two customers. GA was assisted in its investigation by an independent forensic firm. No public-facing websites or systems were affected in this incident.
"We are grateful for the diligent and swift actions that our team took to intercept this attack. Protecting the privacy and security of our students and customers' information is a top priority. As we move forward, we will continue to look for opportunities to enhance our cybersecurity and data protection strategy.”
The Tennessee Higher Education Commission made the announcement on Friday.
“Immediately after determining a possible breach had occurred, our agency, working with the website vendor and the Tennessee Bureau of Investigation (TBI), launched an inquiry focused on ensuring the privacy of Tennessee students,” said THEC Executive Director Mike Krause. “We are, of course, relieved that the inquiry indicated no student data was taken, and want to thank the TBI, the Attorney General and the state’s Strategic Technology Solutions team for their assistance throughout this process.”
Original story:
The Tennessee Higher Education Commission is currently investigating a possible data breach of a 3rd party vendor, that potentially has exposed personal information of thousands of public school students across Tennessee.
The Commission is a state organization focused on assisting high school seniors in every element of accessing higher education.
The Tennessee Higher Education Commission (THEC) and the Department of Education have been notified that Graduation Alliance, a state vendor providing data and web hosting services, encountered a potential incident of unauthorized entry to servers that contained some Tennessee student information.
Graduation Alliance is a third-party vendor that hosts CollegeforTN.org, a college and career-planning website. Immediately upon detecting unusual traffic, the website was taken offline so that a full security assessment could be conducted.
After receiving notice from the vendor, THEC notified the Tennessee Bureau of Investigation and the Office of the Comptroller, as well as all other state agency stakeholders, to ensure a comprehensive response was executed.
THEC Executive Director Mike Krause said that students and their families deserve to have confidence in their pursuit of higher education.
“We’ll be monitoring the investigation closely and will provide updates for students and their parents as information becomes available,” he said. “We are working closely with law enforcement to ensure students’ privacy is protected.”
The information that may have been compromised does not include social security numbers or addresses, only personal information like names, birthdays, gender, ethnicity, and a small portion of records included ACT scores.
Graduation Alliance has hired independent forensic experts to perform a thorough investigation to determine whether any student information was accessed. At this time, no evidence has been found that any student data was viewed or taken from the Graduation Alliance servers.
Officials in the state of Hawaii have reported a similar data breach, and an investigation into that compromise is currently under way.
Any Tennessee parents or students with questions or concerns should call this toll free number set up by the state: 800-342-1663.