Below are the emails DOE sent out Friday, Saturday, and Sunday about
their latest data breach from the use of a file transfer system called MOVEit,
affecting at least 45,000 students
and untold numbers of staff. Articles about the breach were reported in the Daily News, Gothamist, NY Post and Chalkbeat, among others.
The first DOE email below was sent on Friday to
reporters; the second on Saturday to “staff" and the third on Sunday to
families. Lots of unanswered questions here, including why the DOE doesn’t
call this a breach (likely for legal liability reasons); whose Social Security
numbers were exposed, exactly when they discovered the breach, when they
applied the recommended “patches” and when they took the program offline.
The vendor, Progress, announced
the vulnerability on May 31 and offered software “patches” soon after. Minnesota Department of Education announced that student data
was exposed on June 9th, and posted detailed info about the breach on its website on that date,, informing how parents can protect themselves and their children from identity theft at that time..
The federal cybersecurity agency CISA sent out an alert on June 7,that was picked up in several news stories, and again more broadly about the hack on June 15, as did the University of Georgia and Johns Hopkins, that their student data was affected. That same day, the Russian hacking group known as CLOP started listing their victims,
including many businesses, state agencies, financial institutions, and the
National Student Clearinghouse.
Instead of laying out when they had learned about the hack, the DOE email
to reporters bragged that “DOE was identified as
having been impacted by this vulnerability because of a proactive investigation
led by NYC Cyber Command and DOE. NYC Cyber Command and DOE have deployed
additional resources to support this investigation, patch vulnerable systems,
and remediate the vulnerability.” A
proactive investigation how?
It was not until June 24 that the DOE reported the breach on their website, which they call a "data incident."
I sent in a request to the new DOE Chief Privacy Officer, Dennis Doyle, and and Nathaniel Steyer, for the contract and privacy/security provisions for MOVEit, supposed to be posted on the DOE website but of course isn't. I haven't gotten any response as of yet.
As I told the Daily News and Gothamist reporters, this
breach is yet another indication of a troubling lack of seriousness and clarity
evinced by DOE when it comes to protecting personal student data. The huge
Illuminate breach that occurred last year involved nearly one million NYC students, including many
students who had long graduated - data which Illuminate should have deleted already.
Before that there was a breach of the Upguard
system in 2021, and before that, at least
two breaches from data stored on unprotected Google drives; the first one which was not publicly admitted by DOE until the second one occurred.
The Special Commissioner of Investigation excoriated the DOE at length in a Sept. 2021 letter that
I obtained through a FOIL and the two Google drive breaches, as the DOE had falsely assured their office that
they had fixed the problem after the first unsecured Google drive
breach.
In any case, in the annual SCI report for 2021, it was revealed that in January 2022,
the DOE had noted that its “most significant corruption hazards [were] in
the following areas: (1) the procurement, distribution and safeguarding of air
purifiers and (2) data security.”
More recently this past March 2023, a breach of personal
information occurred, including 50,000 records of special education students
contained in billing records issued by a service provider called Encore Support
Services, stored on an unprotected cloud drive. According to the expert
who uncovered the breach, Jeremiah Fowler, each record contained a
student’s name, OSIS number, home address, parent names, the billing amount,
and diagnosis code. Here is a sample redacted portion of the billing
record:
Yet after being contacted by a reporter about this breach, the DOE was adamant that they had no
responsibility to do anything about it or even inform these families, because
these were nonpublic school students whose services they were ordered to pay
for via impartial hearings, and therefore the state studen privacy law did not apply and that they had no "contractual" obligations.
Yet I wonder, didn't those families have a right to know in any
case? In addition, on Checkbook NY, I found that there were nearly a thousand DOE payments to Encore Support Services, since April 11, 2022, listed
under "categorical payments for OTPS" "CW SE INSTR & SCHL LEADERSHIP - OTPS", "GE INSTR & SCH LEADERSHIP - OTPS" and even "UNIVERSAL PRE-K - OTPS", all categories which refer to services provided to public school students rather than those attending non-public schools. Nevertheless, the DOE convinced the reporter I had briefed and her editor not to write about the breach.
_________
From: Styer Nathaniel <NStyer@schools.nyc.gov>
Date: June 23, 2023 at 5:59:43 PM EDT
To: Press Office <press@schools.nyc.gov>
Subject: Update: NYC DOE Data Incident
Dear reporter – please see below for a statement from me and information
on background from NYC DOE and the NYC Cyber Command.
"The safety and security of our students and staff, including their
personal information and data, is of the utmost importance for the New York
City Department of Education. We recently learned of a security vulnerability
in a third-party file-sharing software, MOVEit, which has impacted both private
and government customers globally. Working with NYC Cyber Command, we
immediately took steps to remediate, and an internal investigation revealed
that certain DOE files were affected. Currently, we have no reason to believe
there is any ongoing unauthorized access to DOE systems. We will provide
impacted members of the DOE community with more information as soon as we are
able.”
Background from the DOE: Notifications to individuals whose
confidential information was compromised will begin this summer. Along with the
notification, individuals will be offered access to an identity monitoring
service.
Within hours of learning of the vulnerability, DOE had
fully patched the software as recommended by Progress and the U.S.
Cybersecurity and Infrastructure Security Agency (CISA). Working with NYC Cyber
Command, we immediately began an investigation to determine if data had been
accessed without authorization and engaged a leading e-discovery firm to begin
a full review of the impacted files DOE has also taken the server offline and
is continuing to keep it offline out of an abundance of caution. The e-discovery
firm performed an in-depth analysis, which produced preliminary results on June
23rd.
We are currently cooperating with both NYPD and FBI investigations into
this breach.
The DOE used MOVEit to transfer documents and data internally as well as
to and from vendors, including third-party special education service providers.
Our top priority is determining exactly which confidential information
was exposed, and the specific impact for each affected individual.
- It is estimated
that approximately 45,000 students, in addition to DOE staff and related
service providers, were affected. All individuals whose confidential
information was compromised will be notified.
- Data impacted
includes:
- Social
Security Numbers
- OSIS numbers
- Dates of birth
- Employee IDs
- Approximately
19,000 documents were accessed without authorization.
- The types of
documents that were accessed include student evaluations/related services
progress reports, Medicaid reports related to the provision of related
services, and internal records related to DOE employees’ leave status.
- The types of
data and information impacted for each individual varies from person to
person. For example, not every individual’s SSN was impacted.
Additional Background from NYC Cyber Command:
- Over the past
several weeks, the global cybersecurity community has been responding to
the disclosure of a “zero-day vulnerability” within a file-transfer
software system called MOVEit. This is a vulnerability that was not
previously known by the software company, Progress, or its
customers.
- This
vulnerability impacted customers around the world, including government
entities such as the State of Maryland, the State of Illinois, and the
United States Department of Energy.
- As far as we
know, this vulnerability allowed the threat actor to take files within the
MOVEit application during a limited window of time. There is no indication
that the threat actor attempted or was able to access other parts of the
victims' networks.
- As of now, no
NYC Department of DOE (DOE) data has been published, nor has DOE been
subject to a threat or ransom demand.
- DOE was
identified as having been impacted by this vulnerability because of a
proactive investigation led by NYC Cyber Command and DOE. NYC Cyber
Command and DOE have deployed additional resources to support this
investigation, patch vulnerable systems, and remediate the vulnerability.
There is no indication that this attack is ongoing.
--
Nathaniel Styer
Press Secretary
New York City Public Schools
From: Communications <Communications@schools.nyc.gov>
Sent: Saturday, June 24, 2023 5:53:45 PM
Subject: Information Regarding Data Security Incident
Dear
Staff:
We have
initial information to share about a recently identified security vulnerability in a third-party file-sharing software,
MOVEit. The New York City Department of Education used MOVEit to transfer
documents and data internally as well as to and from vendors, including
third-party special education service providers. This vulnerability affected
customers, including other government agencies, around the globe. Within hours
of learning of the vulnerability, DOE had fully patched the software, working
closely with NYC Cyber Command to remediate. We also took the server offline
and are continuing to keep it offline out of an abundance of caution.
Currently, we have no reason to believe there is any ongoing unauthorized
access to DOE systems.
We also conducted an internal investigation, which revealed that certain
DOE files were affected. Review of the impacted files is ongoing, but
preliminary results indicate that approximately 45,000 students, in addition to
DOE staff and related service providers, were affected. Roughly 19,000
documents were accessed without authorization. The types of data impacted
include Social Security Numbers and employee ID numbers (not necessarily for
all impacted individuals; for example, approximately 9,000 Social Security
Numbers were included).
The safety and security of our students and staff,
including their personal information and data, is of the utmost importance for
the New York City Department of Education. Our top priority is determining
exactly which confidential information was exposed, and the specific impact for
each affected individual. When that determination is made, we will begin
preparing notifications to individuals whose confidential information was
compromised. Along with the notification, individuals will be offered access to
an identity monitoring service.
The
FBI is investigating the broader breach that has impacted hundreds of entities;
we are currently cooperating with both NYPD and FBI as they investigate. Given
that review and investigation are ongoing, we are limited in terms of
additional details at this point. We will continue to work closely with all investigating
agencies and will provide updates as needed. Please know that we are committed
to taking all measures necessary to protect the personal information of our
students and staff. If you have any questions, please email Communications@schools.nyc.gov. Thank
you for your understanding and patience as we work to further address this
situation.
Thank you,
Emma Vadehra
Chief Operating Officer
New York City Department of Education
From: NYC Public Schools <noreply@schools.nyc.gov>
Date: June 25, 2023 at 1:29:05 PM EDT
Subject: Information Regarding Data Security Incident
Reply-To: NYC Public Schools <NoReply@schools.nyc.gov>
Dear Families:
We have initial information to share about a recently identified security vulnerability in a third-party
file-sharing software, MOVEit. The New York City Department of Education used
MOVEit to transfer documents and data internally as well as to and from
vendors, including third-party special education service providers. This
vulnerability affected customers, including other government agencies, around
the globe. Within hours of learning of the vulnerability, DOE had fully patched
the software, working closely with NYC Cyber Command to remediate. We also took
the server offline and are continuing to keep it offline out of an abundance of
caution. Currently, we have no reason to believe there is any ongoing
unauthorized access to DOE systems.
We also conducted an internal
investigation, which revealed that certain DOE files were affected. Review of
the impacted files is ongoing, but preliminary results indicate that
approximately 45,000 students, in addition to DOE staff and related service
providers, were affected. Roughly 19,000 documents were accessed without
authorization. The types of data impacted include Social Security Numbers and
employee ID numbers (not necessarily for all impacted individuals; for example,
approximately 9,000 Social Security Numbers were included).
The safety and security of our
students and staff, including their personal information and data, is of the
utmost importance for the New York City Department of Education. Our top
priority is determining exactly which confidential information was exposed, and
the specific impact for each affected individual. When that determination is
made, we will begin preparing notifications to individuals whose confidential
information was compromised. Along with the notification, individuals will be
offered access to an identity monitoring service.
The FBI is investigating the broader
breach that has impacted hundreds of entities; we are currently cooperating
with both the NYPD and FBI as they investigate. Given that review and investigation
are ongoing, we are limited in terms of additional details at this point. We
will continue to work closely with all investigating agencies and will provide
updates as needed. Please know that we are committed to taking all measures
necessary to protect the personal information of our students and staff. If you
have any questions, please email Communications@schools.nyc.gov. Thank you for your understanding and patience as we work to further
address this situation.
Thank you,
Emma Vadehra
Chief Operating Officer
New York City Department of Education
--
Nathaniel Styer
Press Secretary
New York City
Public Schools
From: Communications
<Communications@schools.nyc.gov>
Sent: Saturday, June 24, 2023 5:53:45 PM
Subject: Information Regarding Data Security Incident
Dear Staff:
We have initial information to share about a recently
identified security vulnerability in a
third-party file-sharing software, MOVEit. The New York City Department of
Education used MOVEit to transfer documents and data internally as well as to
and from vendors, including third-party special education service providers.
This vulnerability affected customers, including other government agencies,
around the globe. Within hours of learning of the vulnerability, DOE had fully
patched the software, working closely with NYC Cyber Command to remediate. We
also took the server offline and are continuing to keep it offline out of an
abundance of caution. Currently, we have no reason to believe there is any
ongoing unauthorized access to DOE systems.
We also conducted an internal
investigation, which revealed that certain DOE files were affected. Review of
the impacted files is ongoing, but preliminary results indicate that
approximately 45,000 students, in
addition to DOE staff and related service providers, were affected. Roughly 19,000 documents were accessed without
authorization. The types of data impacted include Social Security Numbers and
employee ID numbers (not necessarily for all impacted individuals; for example,
approximately 9,000 Social Security Numbers were included).
The
safety and security of our students and staff, including their personal
information and data, is of the utmost importance for the New York City
Department of Education. Our top priority is determining exactly which
confidential information was exposed, and the specific impact for each affected
individual. When that determination is made, we will begin preparing
notifications to individuals whose confidential information was compromised.
Along with the notification, individuals will be offered access to an identity
monitoring service.
The FBI is investigating the
broader breach that has impacted hundreds of entities; we are currently
cooperating with both NYPD and FBI as they investigate. Given that review and
investigation are ongoing, we are limited in terms of additional details at
this point. We will continue to work closely with all investigating agencies
and will provide updates as needed. Please know that we are committed to taking
all measures necessary to protect the personal information of our students and
staff. If you have any questions, please email Communications@schools.nyc.gov. Thank you for your understanding and patience as we work
to further address this situation.
Thank you,
Emma Vadehra
Chief Operating Officer
New York City Department of Education
From: NYC Public Schools <noreply@schools.nyc.gov>
Date: June 25, 2023 at 1:29:05 PM EDT
Subject: Information Regarding Data Security Incident
Reply-To: NYC Public Schools <NoReply@schools.nyc.gov>
Dear Families:
We have initial information to share about a recently identified security vulnerability in
a third-party file-sharing software, MOVEit. The New York City Department of
Education used MOVEit to transfer documents and data internally as well as to
and from vendors, including third-party special education service providers.
This vulnerability affected customers, including other government agencies,
around the globe. Within hours of learning of the vulnerability, DOE had fully
patched the software, working closely with NYC Cyber Command to remediate. We
also took the server offline and are continuing to keep it offline out of an
abundance of caution. Currently, we have no reason to believe there is any
ongoing unauthorized access to DOE systems.
We also
conducted an internal investigation, which revealed that certain DOE files were
affected. Review of the impacted files is ongoing, but preliminary results
indicate that approximately 45,000 students, in addition to DOE
staff and related service providers, were affected. Roughly 19,000 documents
were accessed without authorization. The types of data impacted include Social
Security Numbers and employee ID numbers (not necessarily for all impacted
individuals; for example, approximately 9,000 Social Security Numbers were
included).
The
safety and security of our students and staff, including their personal
information and data, is of the utmost importance for the New York City
Department of Education. Our top priority is determining exactly which
confidential information was exposed, and the specific impact for each affected
individual. When that determination is made, we will begin preparing
notifications to individuals whose confidential information was compromised.
Along with the notification, individuals will be offered access to an identity
monitoring service.
The FBI is investigating the
broader breach that has impacted hundreds of entities; we are currently
cooperating with both the NYPD and FBI as they investigate. Given that review
and investigation are ongoing, we are limited in terms of additional details at
this point. We will continue to work closely with all investigating agencies
and will provide updates as needed. Please know that we are committed to taking
all measures necessary to protect the personal information of our students and
staff. If you have any questions, please email Communications@schools.nyc.gov. Thank you for your understanding and patience as we
work to further address this situation.
Thank
you,
Emma
Vadehra
Chief
Operating Officer
New York
City Department of Education
