A laptop containing thousands of Halton students’ names, numbers and birthdates — even their standardized test scores — has been stolen, prompting the board to warn all parents of a possible privacy breach.
“While we don’t believe data contained on the laptop to be damaging or harmful to student safety, we wanted to alert you of the issue,” education director David Euale said in an email sent last Friday, adding the laptop was stolen from an employee between Jan. 23 and 27.
“The electronic files that may have been compromised due to the theft of the laptop contained student names, student Ontario Education Numbers, birthdates, and data relating to the EQAO testing results for schools within Halton.”
The Halton District School Board has about 54,400 students. The laptop contains information on all students who have written a provincial EQAO test over the past five years, meaning anyone from grades 4 to 12.
Associate director Jeff Blackwell said the computer was password-protected and police believe this “was a crime of opportunity” rather than someone deliberately seeking personal information, as other electronics were also taken.
While most data was encrypted, Blackwell said the board could not confirm if the EQAO testing data was.
The laptop was stolen away from board property.
Georgetown mother Gwen Miron was upset the board sent the email from a “no reply” address, leaving parents with nowhere to direct their questions or concerns.
“They way they did it was cowardly,” she said, adding that parents are always telling their children to be careful about sharing personal information “in real life or over the Internet . . . then to have the school board turn around and do exactly that, it really ticked me off — how irresponsible.”
Miron also wondered why employees are allowed to download such information on a laptop and take it home, rather than keeping it secure on a board server.
Nikolai Fedotov, chief analyst at InfoWatch says: “For now, the police are most probably right: computers are not stolen for their data. It is almost impossible to make money from the information recorded on a computer, and it is quite risky to do so. However, for several years now, thieves have known that the data on laptops, smartphones, tablets and USB sticks can be worth a lot more than the device itself. Even those who are no good with IT at all have learnt this. So, stolen or lost equipment inevitably passes through the hands of “black market experts”. Whatever the circumstances in which it was lost, valuable data is sure to end up on the black market. Unless it has been encrypted.”
