UPDATES AS OF 9/6/19
15. What is the status of the investigation?
The investigation conducted by Graduation Alliance has been completed. The forensic report shared by Graduation Alliance reports that data on the My Future Hawai‘i website shows no evidence of having been stolen. UH News Release, September 6, 2019
16. What is happening next?
UH remains committed to protecting student privacy, and is taking necessary measures to confirm the findings in the forensic report, and to prevent future incidents. UH has since notified Graduation Alliance that the contract will be terminated, indicating that Graduation Alliance failed to implement certain requirements of the agreement intended to protect the data.
While the forensics data report found that there was no evidence that student data was removed, UH officials want to remind families that cyber security best practices recommend that everyone should always monitor their accounts for unusual activities by:
- monitoring all personal accounts for unauthorized activities (these include email accounts, social media accounts, financial accounts, etc.)
- following the Federal Trade Commission’s recommendation on “Protecting Your Identity”.
17. What is the status of My Future Hawai‘i?
The website was shut down immediately upon notice of the potential data exposure in July and will remain shut down. UH apologizes for any inconvenience due to the website being offline; however, UH’s utmost responsibility requires that it ensure proper privacy and security measures for student data. Hawai‘i P-20 is working with HIDOE and UH to find other options to provide schools, students and their families with the tools and resources to continue supporting college and career planning guidance.
1. What happened?
Hawai‘i P-20 Partnerships for Education has learned that a contractor in charge of developing My Future Hawai‘i, a college and career-planning portal for public and charter school students in Hawai‘i, was affected by unauthorized access of its database, potentially exposing student data. The contractor, a company called Graduation Alliance, is working with a cybersecurity firm to complete an investigation to determine if data was exposed.
2. What is My Future Hawai‘i?
My Future Hawai‘i is a website developed to help students to assess their career interests, explore college and career options, and apply to the University of Hawai‘i (UH). Student information such as grades, courses, and test scores are provided to help guide the discussion on preparing and planning for college and careers. Students and counselors can use this tool to track the students’ progress in preparing for college and post-high school plans.
3. Did the data include student social security numbers or other sensitive information?
The data that was potentially exposed does not include social security numbers, financial, driver’s license or health information. None of those items are part of the My Future Hawai‘i application. This potential exposure does not constitute a security breach of personal information under Hawai‘i Revised Statutes Chapter 487N.
4. What types of data were potentially exposed?
For students affected by this unauthorized access, the following data may have been exposed:
- Permanent address
- Mailing address
- Grade level
- Courses taken and grades
- Cumulative weighted Grade Point Average (GPA)
- Smarter Balanced Assessment (SBA) scores and proficiency levels
5. What schools are involved in My Future Hawai‘i?
- Admiral Arthur W. Radford High
- Aiea High
- Kula Kaiapuni O Anuenue
- James B. Castle High
- Connections NCPCS
- Wallace Rider Farrington High
- Hana High and Elementary
- Hawaii Academy of Arts and Science PCS
- Hawaii School for the Deaf and the Blind
- Hawaii Technology Academy PCS
- Henry J. Kaiser High
- Henry Perrine Baldwin High
- Hilo High
- Honokaa High and Intermediate
- James Campbell High
- Kahuku High and Intermediate
- Kailua High
- Kaimuki High
- Kalaheo High
- Kalani High
- Kamaile Academy PCS
- Kanuikapono Learning Center PCS
- Kapaa High
- Kapolei High
- Kau High & Pahala Elementary
- Kauai High
- Kawaikini NCPCS
- Ke Kula Ni’ihau o Kekaha Learning Center A Laboratory PCS
- Ke Kula O Ehunuikaimalino
- Ke Kula ‘o Samuel M. Kamakau, LPCS
- Keaau High
- Kealakehe High
- King Kekaulike High
- Kohala High
- Konawaena High
- Kua o ka La PCS
- Lahainaluna High
- Lanai High & Elementary
- Laupahoehoe Community – PCS
- Leilehua High
- Maui High
- Mililani High
- Moanalua High
- Molokai High
- Nanakuli High & Intermediate
- Pahoa High & Intermediate
- Pearl City High
- Theodore Roosevelt High
- William McKinley High
- Waiakea High
- Waialua High & Intermediate
- Waianae High
- Waimea High
- Waipahu High
- West Hawaii Explorations Academy PCS
- Hilo Intermediate
- Waimea Canyon Middle
- Lahaina Intermediate
- Molokai Middle
- George Washington Middle
- Ilima Intermediate
- Ewa Makai Middle School
- Waipahu Elementary (Limited to 6th grade class)
- Waipahu Intermediate
- Waianae Intermediate
6. What protections are being offered to these students and how many youths did this impact in the state?
An investigation to determine the extent of the potential exposure is underway. Once the investigation is complete, there will be a notification to parents on next steps. Approximately 70,000 student records were potentially exposed. The records potentially exposed did not include social security numbers, or financial or health information.
7. Why is my child’s information on Graduation Alliance’s college access portal?
My Future Hawai‘i was developed to support middle and high school students’ college and career planning, and a formal data sharing agreement between the Hawai‘i State Department of Education (HIDOE) and Hawai‘i P-20 was established to provide the particular information needed for this planning. The information was accessible by HIDOE counselors and students, and used as a planning resource to help middle and high school students develop their postsecondary plan and to be able to apply to UH electronically when they are ready to apply to college. School counselors utilize this tool with their students in a supervised classroom environment to help them assess their interests and explore college and career options.
8. Were parents/students properly notified prior to this data exchange, allowing the ability to opt out in order to preserve the students’ confidentiality?
Parents/guardians were notified, via HIDOE’s annual Parent Notification and Guide to Student Information Privacy, that certain student information from their educational record could be disclosed pursuant to applicable law without parent consent to school officials with legitimate educational interests. http://www.hawaiipublicschools.org/DOE%20Forms/DataGov/FERPAguide.pdf (see item 3 on page 2).
Graduation Alliance, the vendor contracted to manage the My Future Hawai‘i Platform to support middle and high school students’ college and career planning, is an authorized HIDOE school official. Accordingly, consent was not required.
9. Can I expect to receive notification if any of my child’s records were involved?
Information will be sent in the immediate future by email and letters to parents and guardians of students who may have been affected.
10. What measures have been taken to ensure that no further potential exposure/breaches take place?
My Future Hawai‘i has been taken offline. Data transfers involving My Future Hawai‘i have been placed on hold indefinitely. A third-party cyber security vendor has been hired by the vendor, Graduation Alliance to investigate the matter.
11. Have law enforcement authorities received notification?
Yes. Law enforcement has been contacted.
12. Was this data linked to any other Hawai‘i education data?
No. The database that was developed and maintained by Graduation Alliance is not connected in any way to other Hawai‘i education data sources.
13. If my child was attending an elementary school in SY2018-19 and is attending a middle school that participated in My Future Hawai‘i last year, is my child’s data potentially exposed?
14. If my child was attending a non My Future Hawai‘i middle school during the SY2018-19, but is attending a My Future Hawai‘i school this year (SY2019-20), is my child’s data potentially exposed?
If you have any additional questions or concerns, please call 808-956-5800 or email: firstname.lastname@example.org.