SALT LAKE CITY — The superintendent of the Granite School District revealed that the records of an astounding 450,000 current and former students were illegally accessed in a security breach this fall.
Choosing to avoid answering questions in a traditional news conference, the district released a video of Superintendent Ben Horsley personally apologizing for the situation and answering pre-determined questions.
"Not only has my identity been compromised as a result of the breach, but 450,000 of our students' information has been compromised," Horsley said.
Earlier this week, the district announced that student records were also compromised in the breach in which only Granite employees were believed to have been involved. It wasn't until Friday that the scope of the number of students affected was revealed.
The breach was the result of a district employee accidentally downloading a corrupt file, allowing others to access a superuser account via malware between Sept. 11 and Sept. 25.
According to Horsley, a ransom email was received by the district on Sept. 30, which officials refused to pay. On Oct. 15, the district learned that its records had been released onto the dark web.
Days later, the district shared what little information they had on the breach.
"On. Oct. 18, people wanted to know exactly what had been compromised. At that point in time we wanted to make you aware there was a breach, but we did not know and were not able to confirm all the details." Horsley said.
Of the student records that were hacked, 15% contained Social Security numbers, which are not required by the district.
The superintendent said the district spends millions each year on cyber security and data protection services, but that the money for those services comes from classrooms.
"Every dollar I spend over here comes from this pot, so it is this delicate balance of making sure that our systems have integrity, that the data is protected, while at the same time maximizing the amount of resources we send to our classrooms," said Horsley.
During the update, Horsley responded to those who are upset over the lack of information that has been released but claimed he immediately sent out what he knew even if the district didn't have all the information.
"I didn't feel like that was transparent," he said. "I didn't feel like that was appropriate, and that would have put our families behind the 8-ball in terms of getting information secured if it wasn't already."
Horsley said forensic specialists are still trying to identify all the data that was compromised, but that the district will invest more in its security system.
