CHICAGO (WBBM NEWSRADIO) - A data breach involving almost half a million Chicago Public Schools’ students that was disclosed last week should not have happened, according to an education advocacy group.
Cassie Creswell, director of Illinois Families for Public Schools says Battelle for Kids should have notified CPS within 30 days of the December 1st breach, instead of waiting almost five months.
She questions why the vendor was still storing the student information anyway when its old contract with CPS stipulates that data is deleted after it was used in teacher evaluations.
“If you’re not using it anymore, you shouldn’t be holding onto to that data anymore, and so to have data that goes back as far as 2015 from students that have graduated, that should have been deleted by now,” said Creswell.
CPS pointed out there were no social security numbers or financial information disclosed in the breach that included some 60,000 staffers and said it’s working to make sure all vendors handle district data responsibly.
The district started telling parents Friday if their student was – or was not affected – and is offering a year of free credit monitoring.
Creswell said the CPS website is missing information that would help parents know what data is being shared.
The district said there’s no proof the data has been shared or misused and it’s addressing the delay with Battelle.