The South Washington County school district is tightening security after a high school student hacked into the district's server and took names, Social Security numbers and some addresses.
According to a letter sent to teachers and staff last week by Superintendent Keith Jacobus, the student downloaded the data to an external hard drive in early January.
Files for more than 15,000 people were downloaded, said district spokeswoman Barbara Brown. Of that number, 478 people actually had their files opened.
But the district said that the student — who was not identified — provided a sworn statement that no personal data was shared, copied or misused. Forensic evidence collected so far indicates the same thing, said Bob Berkowitz, the district's technology director.
Jacobus said in his letter that the district is investigating, with the help of law enforcement officers, and is in the process of tightening security.
All personal files are being transferred to an encrypted server with a two-factor authentication system, according to the superintendent.
"We understand that you may be concerned about this matter, and we sincerely regret that this incident occurred," Jacobus said in the letter.
The district includes schools in Cottage Grove, St. Paul Park, Newport and Woodbury.
The district is offering free identity theft monitoring to the 478 people whose data was accessed and an informational guide to handling identity theft.
Earlier this month, tax forms were stolen from 2,800 current and former Bloomington public school employees in a phishing scam.
Jessie Bekker is a University of Minnesota student on assignment for the Star Tribune.
