Software vendor for U.S. school districts says data leak was not isolated to Lower Merion. More than 60,000 files potentially exposed.
Diligent Corporation, having previously remained silent, acknowledged that a "misconfiguration" in its BoardDocs app made confidential documents publicly accessible.
A software vendor used by school boards across the country has acknowledged that it experienced a national data breach that may have left more than 60,000 confidential school district documents accessible to the public for an unknown period of time.
The disclosure by Diligent Corp., which develops and markets the school board software BoardDocs, confirms that the leak of private records in the Lower Merion School District, reported last month in The Inquirer, was not an isolated incident.
Nithya Das, chief legal officer at New York-based Diligent, said in an interview Monday that the company has resolved a software “misconfiguration” that caused the security flaw. It has brought in a third-party auditor to determine how long the files might have been accessible.
“Documents that were labeled as private appeared within the BoardDocs application’s search function,” Das said.
BoardDocs is used by about 5,000 school boards and other public sector entities in the United States and Canada to manage board meetings and distribute relevant documents.
About 64,000 private files were “potentially impacted” by the misconfiguration, Das said.
The Inquirer reported May 30 that Lower Merion documents that the school district described as “highly sensitive” were inadvertently published online due to the BoardDocs breach.
Some of the documents — including attorney-client privileged legal memos, confidential employee information, and issues involving students who are identified by their initials — go back as far as 2017. It remains unclear how long they were viewable.
» READ MORE: Lower Merion School District says software glitch caused the release of ‘highly sensitive’ documents
District solicitor Kenneth Roos said school district officials learned of the security flaw in April, when a litigant contacted them in an unrelated legal proceeding. They reached out to Diligent and the issue was resolved, he said.
Lower Merion had not disclosed the security flaw prior to being contacted by The Inquirer last month.
One parent, who requested anonymity for fear of retaliation from the school board or other parents, said they discovered confidential memos while scrolling through school board information on BoardDocs.
“I was like, ‘Wait, how am I reading this?’” the parent said.
Diligent previously declined to provide any information about whether other school districts might have been affected.
The education news site The 74 first reported last week that Diligent has, in fact, been reaching out to school districts about the issue. Some districts that contract with BoardDocs, however, told the site that they were unaware of the problem and received confirmation of a breach only when they contacted Diligent.
Das said on Monday that Diligent took “immediate” action to address the breach when a BoardDocs user reached out and that it deployed an application-wide fix within a short period of time. Das declined to name the client that first made contact about the issue.
“For us, it was a matter of prioritizing remediation of the issue and understanding the scope and size ahead of any notification,” Das said.
Lower Merion continues to use BoardDocs, but Roos said last month that the district has put Diligent “on notice that if we sustain monetary or other damages that we will hold them responsible.”