LAS VEGAS (KTNV) — Several parents have filed a lawsuit against Clark County School District over concerns regarding their students' safety and privacy following recent cybersecurity attacks.
Last Friday, Brandi Hecht, a parent, told Channel 13 that she received an email from a hacker threatening to release her child's personal information onto the dark web.
“All of our kids’ information is out there,” said Hecht. “It puts our kids in danger.”
The email came from a student email at a district in Fresno County, California. It read: “I’m sorry to tell you, but unfortunately, your private information has been leaked.”
“Some hackers had broken into a student email, sent four emails off and then went in and basically deleted evidence of sending it,” said Superintendent Lori Villanueva.
Villanueva said she was alarmed after the incident but did not have any sort of correspondence from the hackers since.
But last week, the same hackers also sent the same identical message to another local television station.
The hackers claimed in the message they asked for less than one third of CCSD superintendent Jesus Jara’s salary, but the demand was not met.
According to the new lawsuit, CCSD and school districts across Nevada have repeatedly been warned about potential for attack on their computer systems back in 2020. But the lawsuit alleges, CCSD did not update software licenses or put password protections in place.
The lawsuit goes on to say a website called DataBreaches.net confirmed the leaked data contained personally identifying information of students including medical records. It also contains redacted samples of the data.
CCSD sent an email to parents Wednesday stating:
“On Oct. 5, 2023, CCSD experienced a cybersecurity incident. The investigation into that incident remains open and active at this time, and CCSD is cooperating with the FBI as they investigate the incident.
We know that many families and staff are frustrated because of this incident, as are we, and we appreciate the patience being granted in this situation. As a district, we are not unique in this vulnerability, as school districts across the country have been victimized similarly, as have private sector entities.
We remain committed to operating within a safe online environment and will continue to secure our technology environment further.
As the investigation continues, we are committed to cooperating with agencies responsible for finding the responsible party and holding them accountable. Rest assured that we will share information as it becomes available so everyone is informed and can respond to protect personal information.”
When Channel 13 reached out to CCSD, the district sent an identical response. The district also told us it will not comment on pending litigation.
The lawsuit filed on Tuesday alleges that CCSD failed to protect students' sensitive personal information by taking the necessary steps to prevent a "sweeping attack that compromised the privacy and security of that data."
It also alleges that CCSD was "aware of its cyber vulnerabilities" but failed to address them in a timely manner. The lawsuit also points to several district policies that require school staff to practice
"Based on information available to CCSD, and in view of the known threat of recent cyber-attacks against school systems, this was an entirely foreseeable event that could and should have been prevented but was not," the lawsuit reads. "...Due to the negligent design of CCSD’s network and the failure to have in place controls and software protections that would identify and/or alert CCSD of an attack, or even prevent an attack in the first place."
The lawsuit also highlights how CCSD was one of several Nevada school districts that issued a warning for potential cyberattacks on their computer systems in the summer of 2020. Only to fall victim to a ransomware attack in August 2020.
The lawsuit claims that approximately 44,000 people were affected by that attack.
Data revealed in the attack includes names, dates of birth, ethnicities, medical information, financial information, student behavioral information, cyberbullying information, student records, employee records, and health insurance information.
Defendants, who are not named in the lawsuit, are asking for a minimum of $15,000 for damages.
A spokesperson for FBI Las Vegas sent a statement reading:
“To preserve the integrity of the investigation, I cannot share any operational details regarding this case, but can assure you we are actively working with our law enforcement and interagency partners to determine the nature and scope of this breach and to identify those responsible for it.”
Those with questions or concerns about this incident can call CCSD’s assistance line at 888-566-5512.
