School officials and police are investigating after a staff member shared the personal information of 3,000 Waukegan Public Schools students with a “third party.”
Waukegan Public Schools Associate Superintendent of Information Josue Cuevas said in a message to parents that a spreadsheet containing information on approximately 3,000 students at Waukegan High School and AOEC was exposed.
Cuevas said a staff member in the district shared the information with a “third-party individual” without authorization.
The district said they cannot release the identity of the third-party individual as it remains an open investigation.
First and last names, home addresses, outstanding fees owed and parent-guardian names were released. No other personally identifiable information was reported to be released.
The third party who received the students’ and parents’ information notified the school district’s Information Technology Services Department.
“Immediately, the technology department disabled all access for the staff member who released the information, and an investigation was opened,” Cuevas said.
Cuevas declined to say why the staff member released the information to the third party.
The school district said they have no indication that the data was shared with ICE or other federal agencies.
“The private individual who received [it] did not have any indicators that would implicate immigration status,” Cuevas said.
The school district said they will be reminding all staff about the proper handling of confidential student information.
Cuevas also said that the Waukegan Police Department was notified and a police report was made.
“We deeply regret any concern or inconvenience this incident may cause you and your family. The security of your personal information is of the utmost importance to us, and we are committed to implementing additional safeguards to protect against unauthorized access,” the district told parents.
Administration from Waukegan Public Schools held an informational online meeting on Thursday to discuss the data breach.