More than 380,000 additional NYC students had personal info hacked, bringing total to over 1M

More than 380,000 further metropolis public-school students had their individual information hacked successful a monolithic cyber onslaught — bringing nan full number of kids affected to good complete 1 million, The Post has learned.

The New York City Department of Education past week began sending letters notifying nan hundreds of thousands of further existent and erstwhile students that they were victims of nan cyber onslaught involving 1 of nan DOE’s erstwhile package vendors, according to a missive sent to 1 postgraduate and reviewed by The Post.

The DOE initially reported that astir 800,000 existent and erstwhile students were affected but was notified by nan vendor successful October that scores of further kids besides were victims, nan section said.

The hacked individual accusation includes a student’s name, day of birth, ethnicity, world records and schoolhouse enrollment, nan DOE missive said.

No societal information aliases financial accusation was breached, acquisition officials said.

The DOE said it is offering nan impacted students — immoderate of whom moreover graduated from nan strategy respective years earlier nan information breach occurred — 2 years of free in installments and identity-monitoring services done vendor IDX to thief protect against identity theft.

The information breach occurred successful precocious December 2021 to early January 2022 with the DOE’s-then package institution Illuminate, which offers grading, attending and messaging platforms.

The metropolis public-school strategy has since severed ties pinch Illuminate.

The caller missive to affected erstwhile and existent students provides a nexus to an updated security notice on nan DOE website that says, “Approximately 387,000 existent and erstwhile NYCPS students were recently identified arsenic being affected by Illuminate’s information information incident successful 2022.” A DOE rep said that fig is much for illustration 381,000.

Another 94,000 existent and erstwhile public-school students besides are receiving a 2nd announcement because Illuminate identified “additional accusation of theirs that was affected by nan 2022 information information incident,” nan DOE said.

“New York Public Schools is penning you pinch an update connected a information information incident that occurred 2 years agone involving nan institution Illuminate Education,” said nan missive sent from DOE Chief Information Officer Intekhab Shakil and Chief Privacy Officer Dennis Doye to nan affected students past week. “NYCPS is handling this business pinch nan utmost seriousness.”

In May 2022, metropolis acquisition officials notified nan antecedently identified 800,000 students impacted by nan breach.

In nan caller letter, nan DOE cybersecurity officials said Illuminate notified the city schoolhouse strategy successful October of past twelvemonth that it became alert that “additional individuals were affected by nan 2022 information information incident.

“You are 1 of nan individuals who Illuminate precocious identified arsenic being affected by nan 2022 information information incident,” Shakil and Doyle said successful nan missive to 1 of the affected students.

The DOE officials insisted they person beefed up cybersecurity protocols and emphasized that they are holding contractors accountable to protect students’ privacy.

“NYCPS is committed to protecting nan privateness of our students’ individual information. We person a broad information compliance process successful spot to thief make judge that companies who entree student accusation work together to comply pinch federal, state, and section laws and thief protect your data,” nan officials said successful nan letter.

“Following nan 2022 Illuminate incident, NYCPS besides took steps to further guarantee that schools do not usage package products that impact vendors receiving aliases accessing student accusation unless and until nan vendors afloat complete our compliance process.”

As for nan 2 years of free in installments and identity-monitoring services being offered to those affected, “There is nary costs to you, but you must enroll and activate nan services yoursel,” nan DOE said.

The deadline to enroll is July 30, 2024. 

The cybersecurity breach was not nan only 1 that has impacted metropolis public-school students and employees.

Last summer, 45,000 students, schoolhouse workers and work providers were affected by a abstracted hack onslaught that included Social Security numbers, dates of birth, worker IDs and OSIS numbers – nan nine-digit numbers issued to each students who be a metropolis nationalist school.

Overall, 19,000 documents were accessed from nan record transportation strategy MOVEIt, and 9,000 Social Security numbers were stolen, nan DOE said successful a missive sent to unit astatine nan time.

As nan information breaches came to light, nan DOE’s erstwhile chief exertion officer, Anuraag Sharma, resigned past summer.

Schools are not nan only juicy targets of hackers.

Medical accommodation that support delicate records of patients person been subjected to cyber attacks, notably nan One Brooklyn Health network that oversees Brookdale, Interfaith and Kingsbrook Jewish hospitals.

DOE spokeswoman Jenna Lyle told The Post successful an emailed connection Sunday, “As we person said from nan start, nan information and wellbeing of each our students and staff, including nan information of their data, is our absolute apical priority. 

“This caller information, much than 2 years aft nan fact, is concerning and further validates our determination successful Spring of 2022 to barroom Illuminate from moving pinch NYCPS aliases immoderate of our schools. Our students and schoolhouse communities merit better.”