Technical problem causes security breach in Tooele County School District

TOOELE, Utah — Hundreds of students’ personal information was potentially compromised in what the Tooele County School District called a “technical problem” as the district switched from Aspire to Skyward.

Skyward is a software company specializing in K-12 school management. It includes student records and personal information.

This week, families of the over 21,000 students attending school in the TCSD received an email letting them know Skyward was up and running and all students must be registered through Skyward before the start of the new school year next month.

When Samantha Mamales logged in, she was horrified when she found a random child attached to her account. She could see a picture, address, student ID and personal data about the student. Not only that, but her own daughter wasn’t on the account at all. She was outraged.

“It’s my information and then when I get to the kids I had a completely different kid,” Mamales said. “I had access to all of her information.”

She panicked, wondering if she has another child’s info, where are her daughter’s records?

She called the Tooele County School District, which informed her it was having some issues with Skyward. A few hours later, the district posted on its Facebook page, saying, in part:

Dear TCSD families,

Until further notice, we are removing access to the Skyward student information system due to technical difficulties. We apologize for any inconvenience. You will be notified once the system is back up and running. We appreciate your patience as we onboard a new system and we work through the “bugs.”

Once the system is back up, families can complete their registration packet. Class schedule changes will not occur until August.

Thank you again for your patience and understanding.

But Mamales said she could still access the personal information of that student and still had the ability to change it hours after that post.

“I had the ability to change her school. I had the ability to change her address, I had the ability to change everything on this kid,” she said.

Now, Skyward is locked. Mamales wants to be sure her daughter’s information is secure before the school opens the program again to parents.

Thursday morning, TCSD officials said they believe about 1,000 students were impacted and were working with Skyward to determine what information was seen.

“From what we can tell so far it was a small percentage of families and only directory type information was shown,” they said. “We have notified the state office to make sure we are following proper protocols for this type of situation and Skyward has assured us they are working line-by-line going through to see where the error was and what information was seen.”

The Skyward project management team manager said, “Rest assured we have management on our end aware of this and working feverishly on the best way to handle this for your district.”

— Tooele Schools (@tooeleschools) July 21, 2022