According to the website thejournal.ie this morning, personal records of thousands of secondary school pupils could be available to view by any internet user.

A serious security flaw in a schools data management system used by many secondary schools means that sensitive data such as pupils academic records, parents details and disciplinary history is available to anyone with only a generic username and password which is said to have been leaked online.

The systems, which run on servers physically installed in the schools, use ‘ePortal’ software created by the British services giant Serco and can be accessed remotely through the internet if you know the generic username and password.

thejournal.ie outlines how by using the ‘master key’ credentials, it was able to access records of a number of students in various schools. These records included:

*The pupil’s photograph
*Their date of birth
*Their parents’ names and contact phone numbers
*Details of any of the pupil’s siblings who are also enrolled in the school
*The name of the pupil’s family doctor
*The classes in which that pupil is enrolled, and their individual timetable
*The pupil’s attendance records
*Records of the student’s misconduct, including disruptive behaviour or homework not completed, and
*Results of that pupil’s in-house examinations for as long as the system has been live, and their results in any state exams.

According to thejournal.ie, the issue came to light last Wednesday when a parent notified the Department of Education that their child had been able to log into their own school’s server, and that of another school, using only the generic username and password. The Department has informed Serco of the breach and has notified school managerial bodies

Comments