Lower Merion School District says software glitch caused the release of ‘highly sensitive’ documents

The Lower Merion School District said on Thursday that an unknown number of “highly sensitive” documents were inadvertently published online due to what it described as a security breach involving its school board-management software.

The software, BoardDocs, is used by school districts around the country to manage board meetings and post agendas and related information. It is unclear if districts outside Lower Merion have been affected.

Lower Merion’s solicitor, Kenneth Roos, said the school district first learned of the breach on April 10, when it was contacted by a litigant in a legal proceeding unrelated to the breach.

Roos said internal records from the “executive” section of the BoardDocs site had at some point become accessible to the public. School board members were notified and the problem was resolved, he said.

The district had not publicly disclosed the breach prior to being contacted by The Inquirer this week.

The leaked documents included attorney-client privileged legal memos that discuss ongoing litigation, confidential employee information, and issues involving students who are identified by their initials.

One memo, for instance, refers to an investigation of an elementary school teacher. A mother had accused him of “predatory behavior” toward her son.

Police and Montgomery County child welfare officials declined to charge the teacher with any inappropriate conduct, but the teacher was suspended without pay briefly for violating the school district’s adult/student boundaries policy “on several occasions,” according to the memo.

Roos said BoardDocs, which is developed and marketed by New York-based Diligent Corporation, “eventually acknowledged there was a bug or defect in the system” that led to the breach.

It remains unclear exactly how many internal Lower Merion documents were publicly accessible and for how long. The Inquirer obtained and reviewed a sample of confidential records from 2017 to 2024.

Nor is it known whether the apparent bug could have impacted other school districts that use BoardDocs.

“That’s a really good question,” Roos said.

Diligent’s senior director of communications, Michele Steinmetz, declined to comment on the Lower Merion issue or whether any other districts have reported similar leaks.

“We understand this inquiry may be related to a school district’s active litigation, and it is our policy not to comment on ongoing litigation,” Steinmetz said by email.

Steinmetz did not cite specific litigation or respond to follow-up questions. Lower Merion has not sued the company. But Roos said it had “put them on notice that if we sustain monetary or other damages that we will hold them responsible.”

Diligent says BoardDocs and its other board portal software has more than 145,000 users worldwide. BoardDocs, developed in 2000, offers “customizable security” to keep agenda items and documents private or make them public, according to its website.

“In today’s climate of escalating security risk and increasingly high stakes, boards can’t leave security to chance,” the site states. “Diligent delivers peace of mind with state-of-the-art encryption, data storage, access controls and more.”

Lower Merion spokeswoman Amy Buckman said the leaked documents were “highly sensitive” and should not have been made public.

One parent told The Inquirer of discovering the trove of confidential memos while looking through Lower Merion school board information on BoardDocs.

“I was like, ‘Wait, how am I reading this?’ It’s weird,” said the parent, who requested anonymity due to fear of retaliation from the school board and other parents.

Officials from the Pennsylvania School Boards Association and the Pennsylvania State Education Association, the teachers union, declined to comment on the apparent data breach.

Lower Merion School District, located on the affluent Main Line in suburban Philadelphia, recently ranked as the third best school district in the state, according to the Pittsburgh Business Times school guide, which bases its rankings on standardized test scores.

The district recently hired Frank Ranelli, former superintendent of Piscataway Township Schools in Middlesex County, N.J., after a series of leadership changes. It is also recovering from an unusually contentious school board primary that included debate over antisemitism and diversity, equity, and inclusion initiatives.

Last month, Amazon Prime Video released Spy High, a four-episode docuseries that reexamined the 2010 Webcamgate scandal. The district made international headlines that year amid the disclosure that it had captured images of students in their homes using the webcams on their school-issued laptops.

Inquirer staff writer Maddie Hanna contributed to this article.