The breadth of a cyber attack against San Diego Unified School District last year is coming into view. Student medical records may have been taken during the hack, district officials notified parents in a letter dated May 4.
San Diego Unified officials discovered the hack on Oct. 25, 2022. They notified parents more than a month later, but released few details about the attack. In December, NBC 7 confirmed that the personal information of many district employees was compromised in the breach.
The new letter obtained by Voice of San Diego is the first admission that children’s medical information was involved.
“We reviewed the files that were taken and determined that the stolen data may include your child’s name and medical information,” wrote Dennis Monahan, the district’s director of risk services, in the letter.
The letter did not provide any information about the type of medical information that might have been taken. It’s also unclear exactly how many parents received the letter. District officials were not immediately available for comment.
Barbara Voit, the parent of a special education student, received the letter.
“We generally share a lot of medical records [with the district] so I am very concerned,” she wrote in an email.
Voit said she shares medical records regarding her child’s diagnosis with the district, as well as assessment reports from various medical professionals.
She emailed the district to find out if they would provide free credit monitoring and whether information that specifically identified her child’s disability had been compromised.
She has not heard back.
Exactly who is responsible for the attack also remains unclear. Law enforcement officials were called in to assist with the case, NBC 7 reported last year. San Diego Unified officials have only said the information was accessed by “an unauthorized party.”
Los Angeles Unified School District was hacked just weeks before San Diego Unified last year. Hackers target districts for valuable personal information and in some cases have tried to extort districts, NBC 7 reported.
nice
I received a letter from SDUSD last week. Why they are notifying parents that our child’s medical records have been breached 6+ months after the fact is beyond me. This is the at least the second time that I’ve received notice that my children’s information may have been compromised. SDUSD needs to get it together and do a better job of protecting our kids information including medical information.