NewsCovering Colorado


Students' private information leaked, Districts reveals details about data breach earlier this year

Posted at 8:08 PM, May 04, 2022
and last updated 2022-05-05 17:06:22-04

PUEBLO — Someone, somewhere knows details about thousands of students in southern Colorado after a data breach through a separate organization occurred earlier this year.

On Tuesday, District 70 sent parents a letter outlining the details of the breach which happened through Illuminate Education, a vendor the district uses. District 12 sent a similar letter to parents on April 29.

The letter reveals that an investigation confirms "certain databases, containing potentially protected student information were subject to unauthorized access between December 28, 2021 and January 8, 2022".

Letter from District 70 regarding data breach.

D70 says it informed parents of the breach quickly after the district received the news.

"I was kind of up in arms, a little bit frustrated with the time that it took to get the information out to us and the way it was sprung on us," says Paul Hendricksen, a father of a student in District 70.

Hendricksen has also worked in information security for about 15 years.

"Your information being exposed like this, would be like going down to isle 13 in Walmart and having a random stranger stop and look at both of your children and say - I can't believe they both were born in September in August," says Hendricksen.

D70 says they have pulled all data from Illuminate Education and will not be doing business with them in the future. D12's letter to parents referred to the company as a "former" vendor.

Email from District 12 regarding the data breach.

"The deferment of responsibility to others, does not preclude the responsibility of the person who hired the vendor. The buck stops... at the Board President and the superintendent's desk and the decision was made by them," said Hendricksen.

One of Hendricksen's primary concerns with the data breach is the possibility of child identity theft, when a criminal might use a child's information to commit fraud.

"My privacy as a parent and as a cyber security expert is paramount, but that of my children is even more so."

If a child is younger than 16 years old, parents can freeze their child's credit by contacting each of the three credit bureaus, whose contact information can be found here.


Watch KOAA News5 on your time, anytime with our free streaming app available for your Roku, FireTV, AppleTV and Android TV. Just search KOAA News5, download and start watching.